windows-nt/Source/XPSP1/NT/net/tcpip/driver/ipsec/sys/saapi.c

/*++

Copyright (c) 1997-2001  Microsoft Corporation

Module Name:

    saapi.c

Abstract:

    This module contains the SAAPI implementation

Author:

    Sanjay Anand (SanjayAn) 12-May-1997
    ChunYe

Environment:

    Kernel mode

Revision History:

--*/


#include "precomp.h"


#pragma hdrstop


#ifdef  ALLOC_PRAGMA
#pragma alloc_text(PAGE, IPSecInitRandom)
#endif


BOOLEAN
IPSecInitRandom(
    VOID
    )
/*++

Routine Description:

	Initialize the IPSecRngKey by calling into ksecdd to get 2048 bits of random
    and create the RC4 key.

Arguments:

    Called at PASSIVE level.

Return Value:

    TRUE/FALSE

--*/
{
    UCHAR   pBuf[RNG_KEY_SIZE];

    PAGED_CODE();

    if (IPSEC_GEN_RANDOM(pBuf, RNG_KEY_SIZE) == FALSE) {
        IPSEC_DEBUG(LOAD, ("IPSEC_GEN_RANDOM failure.\n"));
        return  FALSE;
    }

    //
    // Generate the key control structure.
    //
    IPSEC_RC4_KEY(&IPSecRngKey, RNG_KEY_SIZE, pBuf);

    return  TRUE;
}


VOID
IPSecRngRekey(
    IN  PVOID   Context
    )
/*++

Routine Description:

	Initialize the IPSecRngKey by calling into ksecdd to get 2048 bits of random
    and create the RC4 key.

Arguments:

    Called at PASSIVE level.

Return Value:

    None.

--*/
{
    IPSecInitRandom();

    IPSEC_DECREMENT(g_ipsec.NumWorkers);

#if DBG
    IPSecRngInRekey = 0;
#endif

    IPSEC_SET_VALUE(IPSecRngBytes, 0);
}


BOOLEAN
IPSecGenerateRandom(
    IN  PUCHAR  pBuf,
    IN  ULONG   BytesNeeded
    )
/*++

Routine Description:

	Generate a positive pseudo-random number between Lower and Upper bounds;
    simple linear congruential algorithm. ANSI C "rand()" function. Courtesy JameelH.

Arguments:

	LowerBound, UpperBound - range of random number.

Return Value:

	a random number.

--*/
{
    ULONG   RngBytes;

    IPSEC_RC4(&IPSecRngKey, BytesNeeded, pBuf);

    //
    // Rekey if we have exceeded the threshold.
    //
    RngBytes = IPSEC_ADD_VALUE(IPSecRngBytes, BytesNeeded);
    if (RngBytes <= RNG_REKEY_THRESHOLD &&
        (RngBytes + BytesNeeded) > RNG_REKEY_THRESHOLD) {
        //
        // Create a worker thread to perform the rekey since it has to be done
        // as paged code.
        //
#if DBG
        ASSERT(IPSecRngInRekey == 0);
        IPSecRngInRekey = 1;
#endif

        ExInitializeWorkItem(   &IPSecRngQueueItem,
                                IPSecRngRekey,
                                NULL);

        ExQueueWorkItem(&IPSecRngQueueItem, DelayedWorkQueue);

        IPSEC_INCREMENT(g_ipsec.NumWorkers);
    }

    return  TRUE;
}


VOID
IPSecCleanupOutboundSA(
    IN  PSA_TABLE_ENTRY pInboundSA,
    IN  PSA_TABLE_ENTRY pOutboundSA,
    IN  BOOLEAN         fNoDelete
    )
/*++

Routine Description:

    Deletes an outbound SA.

    Called with SADB lock held, returns with it.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    KIRQL   kIrql;

    IPSEC_DEBUG(ACQUIRE, ("Deleting assoc (outbound) SA: %lx\n", pOutboundSA));

    pInboundSA->sa_AssociatedSA = NULL;

    //
    // de-link from the Filter lists
    //
    if (pOutboundSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
        pOutboundSA->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
        IPSecRemoveEntryList(&pOutboundSA->sa_FilterLinkage);
    }

    //
    // So, we dont delete the Rekeyoriginal SA again.
    //
    if (pOutboundSA->sa_Flags & FLAGS_SA_REKEY_ORI) {
        pOutboundSA->sa_Flags &= ~FLAGS_SA_REKEY_ORI;
        if (pOutboundSA->sa_RekeyLarvalSA) {
            ASSERT(pOutboundSA->sa_RekeyLarvalSA->sa_Flags & FLAGS_SA_REKEY);
            pOutboundSA->sa_RekeyLarvalSA->sa_RekeyOriginalSA = NULL;
        }
    }

    //
    // invalidate the associated cache entry
    //
    IPSecInvalidateSACacheEntry(pOutboundSA);

    pOutboundSA->sa_State = STATE_SA_ZOMBIE;
    pOutboundSA->sa_AssociatedSA = NULL;

    if (pOutboundSA->sa_Flags & FLAGS_SA_HW_PLUMBED) {
        IPSecDelHWSAAtDpc(pOutboundSA);
    }

    IPSEC_DEBUG(REF, ("Out Deref IPSecCleanupOutboundSA\n"));
    IPSecStopTimerDerefSA(pOutboundSA);

    IPSEC_INC_STATISTIC(dwNumKeyDeletions);
}


VOID
IPSecCleanupLarvalSA(
    IN  PSA_TABLE_ENTRY  pSA
    )
/*++

Routine Description:

    Delete the LarvalSA.

    Called with Outbound Lock held, returns with it.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    PSA_TABLE_ENTRY pOutboundSA;
    KIRQL           kIrql1;
    KIRQL           kIrql2;

    //
    // Also remove from Pending list if queued there.
    //
    ACQUIRE_LOCK(&g_ipsec.AcquireInfo.Lock, &kIrql1);
    if (pSA->sa_Flags & FLAGS_SA_PENDING) {
        ASSERT(pSA->sa_State == STATE_SA_LARVAL);
        IPSEC_DEBUG(ACQUIRE, ("IPSecSAExpired: Removed from pending too: %lx\n", pSA));
        IPSecRemoveEntryList(&pSA->sa_PendingLinkage);
        pSA->sa_Flags &= ~FLAGS_SA_PENDING;
    }
    RELEASE_LOCK(&g_ipsec.AcquireInfo.Lock, kIrql1);

    //
    // Flush all the queued packets
    //
    IPSecFlushQueuedPackets(pSA, STATUS_TIMEOUT);

    //
    // remove from inbound sa list
    //
    AcquireWriteLock(&g_ipsec.SPIListLock, &kIrql1);
    IPSecRemoveSPIEntry(pSA);
    ReleaseWriteLock(&g_ipsec.SPIListLock, kIrql1);

    //
    // invalidate the associated cache entry
    //
    ACQUIRE_LOCK(&pSA->sa_Lock, &kIrql2);
    if (pSA->sa_AcquireCtx) {
        IPSecInvalidateHandle(pSA->sa_AcquireCtx);
        pSA->sa_AcquireCtx = NULL;
    }
    RELEASE_LOCK(&pSA->sa_Lock, kIrql2);

    IPSecInvalidateSACacheEntry(pSA);

    if (pSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
        pSA->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
        IPSecRemoveEntryList(&pSA->sa_FilterLinkage);
    }

    if (pSA->sa_RekeyOriginalSA) {
        ASSERT(pSA->sa_Flags & FLAGS_SA_REKEY);
        ASSERT(pSA->sa_RekeyOriginalSA->sa_RekeyLarvalSA == pSA);
        ASSERT(pSA->sa_RekeyOriginalSA->sa_Flags & FLAGS_SA_REKEY_ORI);

        pSA->sa_RekeyOriginalSA->sa_Flags &= ~FLAGS_SA_REKEY_ORI;
        pSA->sa_RekeyOriginalSA->sa_RekeyLarvalSA = NULL;
        pSA->sa_RekeyOriginalSA = NULL;
    }

    if (pOutboundSA = pSA->sa_AssociatedSA) {

        IPSEC_DEC_STATISTIC(dwNumActiveAssociations);
        IPSEC_DEC_TUNNELS(pOutboundSA);
        IPSEC_DECREMENT(g_ipsec.NumOutboundSAs);

        IPSecCleanupOutboundSA(pSA, pOutboundSA, FALSE);
    }

    IPSEC_DEBUG(REF, ("In Deref DeleteLarvalSA\n"));
    IPSecStopTimerDerefSA(pSA);
}


VOID
IPSecDeleteLarvalSA(
    IN  PSA_TABLE_ENTRY  pSA
    )
/*++

Routine Description:

    Delete the LarvalSA.

    Called with Outbound Lock held, returns with it.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    KIRQL   kIrql;

    ASSERT((pSA->sa_Flags & FLAGS_SA_OUTBOUND) == 0);

    //
    // Remove from larval list
    //
    ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &kIrql);
    IPSecRemoveEntryList(&pSA->sa_LarvalLinkage);
    IPSEC_DEC_STATISTIC(dwNumPendingKeyOps);
    RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);

    //
    // Cleanup the rest of larval SA
    //
    IPSecCleanupLarvalSA(pSA);
}


VOID
IPSecDeleteInboundSA(
    IN  PSA_TABLE_ENTRY  pInboundSA
    )
/*++

Routine Description:

    Deletes the corresponding outbound SA, and then deletes itself.

    Called with Outbound Lock held, returns with it.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    PSA_TABLE_ENTRY pOutboundSA;
    PSA_TABLE_ENTRY pSA;
    KIRQL           kIrql;
    PLIST_ENTRY     pEntry;
    PFILTER         pFilter;

    ACQUIRE_LOCK(&g_ipsec.AcquireInfo.Lock, &kIrql);
    IPSecNotifySAExpiration(pInboundSA, NULL, kIrql, FALSE);

    if (pOutboundSA = pInboundSA->sa_AssociatedSA) {

        IPSEC_DEC_STATISTIC(dwNumActiveAssociations);
        IPSEC_DEC_TUNNELS(pOutboundSA);
        IPSEC_DECREMENT(g_ipsec.NumOutboundSAs);

        IPSecCleanupOutboundSA(pInboundSA, pOutboundSA, FALSE);
    }

    IPSEC_DEBUG(ACQUIRE, ("Deleting inbound SA: %lx\n", pInboundSA));

    //
    // remove from inbound sa list
    //
    AcquireWriteLock(&g_ipsec.SPIListLock, &kIrql);
    IPSecRemoveSPIEntry(pInboundSA);
    ReleaseWriteLock(&g_ipsec.SPIListLock, kIrql);

    //
    // invalidate the associated cache entry
    //
    IPSecInvalidateSACacheEntry(pInboundSA);

    //
    // also remove from the filter list
    //
    if (pInboundSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
        pInboundSA->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
        IPSecRemoveEntryList(&pInboundSA->sa_FilterLinkage);
    }

    if (pInboundSA->sa_Flags & FLAGS_SA_HW_PLUMBED) {
        IPSecDelHWSAAtDpc(pInboundSA);
    }

    ASSERT(pInboundSA->sa_AssociatedSA == NULL);

    IPSEC_DEBUG(REF, ("In Deref DeleteInboundSA\n"));
    IPSecStopTimerDerefSA(pInboundSA);
}


VOID
IPSecExpireInboundSA(
    IN  PSA_TABLE_ENTRY  pInboundSA
    )
/*++

Routine Description:

    Deletes the corresponding outbound SA, and places itself (inbound) on timer
    Queue for later.

    NOTE: Called with SADB lock held.
Arguments:


Return Value:

    The final status from the operation.

--*/
{
    PSA_TABLE_ENTRY pOutboundSA;
    KIRQL           OldIrq;
    KIRQL           kIrql;

    if (pInboundSA->sa_Flags & FLAGS_SA_HW_PLUMBED) {
        IPSecDelHWSAAtDpc(pInboundSA);
    }

    ACQUIRE_LOCK(&g_ipsec.AcquireInfo.Lock, &OldIrq);
    IPSecNotifySAExpiration(pInboundSA, NULL, OldIrq, FALSE);

    if (pOutboundSA = pInboundSA->sa_AssociatedSA) {

        IPSEC_DEC_STATISTIC(dwNumActiveAssociations);
        IPSEC_DEC_TUNNELS(pOutboundSA);
        IPSEC_DECREMENT(g_ipsec.NumOutboundSAs);

        IPSecCleanupOutboundSA(pInboundSA, pOutboundSA, TRUE);
    }

    IPSEC_DEBUG(ACQUIRE, ("Queueing inbound SA: %lx\n", pInboundSA));

    //
    // Place this on the timer Q so it gets cleared when the next interval hits.
    //
    ACQUIRE_LOCK(&pInboundSA->sa_Lock, &kIrql);

    if (pInboundSA->sa_AcquireCtx) {
        IPSecInvalidateHandle(pInboundSA->sa_AcquireCtx);
        pInboundSA->sa_AcquireCtx = NULL;
    }

    IPSecStartSATimer(  pInboundSA,
                        IPSecSAExpired,
                        IPSEC_INBOUND_KEEPALIVE_TIME);

    RELEASE_LOCK(&pInboundSA->sa_Lock, kIrql);
}


NTSTATUS
IPSecCheckInboundSA(
    IN  PSA_STRUCT             pSAStruct,
    IN  PSA_TABLE_ENTRY        pSA
    )
/*++

Routine Description:

    Ensures that the SA being updated is actually the SA we initially
    kicked off negotiation for.

Arguments:

    pSAInfo - information about the SA

    pSA - SA to be populated.

Return Value:

    STATUS_PENDING if the buffer is to be held on to, the normal case.

Notes:


--*/
{
    LARGE_INTEGER   uliSrcDstAddr;
    LARGE_INTEGER   uliSrcDstMask;
    LARGE_INTEGER   uliProtoSrcDstPort;
    PSECURITY_ASSOCIATION   pSAInfo = &pSAStruct->SecAssoc[pSAStruct->NumSAs - 1];


    IPSEC_BUILD_SRC_DEST_ADDR(  uliSrcDstAddr,
                                pSAStruct->InstantiatedFilter.SrcAddr,
                                pSAStruct->InstantiatedFilter.DestAddr);

    IPSEC_BUILD_SRC_DEST_MASK(  uliSrcDstMask,
                                pSAStruct->InstantiatedFilter.SrcMask,
                                pSAStruct->InstantiatedFilter.DestMask);

    IPSEC_BUILD_PROTO_PORT_LI(  uliProtoSrcDstPort,
                                pSAStruct->InstantiatedFilter.Protocol,
                                pSAStruct->InstantiatedFilter.SrcPort,
                                pSAStruct->InstantiatedFilter.DestPort);

    IPSEC_DEBUG(ACQUIRE, ("IPSecCheckInboundSA: S: %lx-%lx, D: %lx-%lx\n",
                SRC_ADDR, SRC_MASK, DEST_ADDR, DEST_MASK));
    IPSEC_DEBUG(ACQUIRE, ("IPSecCheckInboundSA: SA->S: %lx-%lx, SA->D: %lx-%lx\n",
                pSA->SA_SRC_ADDR, pSA->SA_SRC_MASK, pSA->SA_DEST_ADDR, pSA->SA_DEST_MASK));

    if ((pSA->sa_TunnelAddr != 0) || (pSA->sa_Flags & FLAGS_SA_TUNNEL)) {
        if (((SRC_ADDR & pSA->SA_SRC_MASK) ==
             (pSA->SA_SRC_ADDR & pSA->SA_SRC_MASK)) &&
            ((DEST_ADDR & pSA->SA_DEST_MASK) ==
             (pSA->SA_DEST_ADDR & pSA->SA_DEST_MASK)) &&
            (pSA->sa_SPI == pSAInfo->SPI)) {
            return STATUS_SUCCESS;
        }
    } else {
        if ((uliSrcDstAddr.QuadPart == pSA->sa_uliSrcDstAddr.QuadPart) &&
            (pSA->sa_SPI == pSAInfo->SPI)) {
            return STATUS_SUCCESS;
        }
    }

    return  STATUS_FAIL_CHECK;
}


BOOLEAN
IPSecIsWeakDESKey(
    IN  PUCHAR  Key
    )
/*++

Routine Description:

    Checks for weak DES keys

Arguments:

    Key - the key to be checked.

Return Value:

    TRUE/FALSE

Notes:

--*/
{
    ULONG   j;

    for (j = 0; j < NUM_WEAK_KEYS; j++) {
        if (IPSecEqualMemory(Key, weak_keys[j], DES_BLOCKLEN)) {
            return  TRUE;
        }
    }

    return  FALSE;
}


BOOLEAN
IPSecIsWeak3DESKey(
    IN  PUCHAR  Key
    )
/*++

Routine Description:

    Checks for weak Triple DES keys

Arguments:

    Key - the key to be checked.

Return Value:

    TRUE/FALSE

Notes:

--*/
{
    if (IPSecEqualMemory(Key, Key + DES_BLOCKLEN, DES_BLOCKLEN) ||
        IPSecEqualMemory(Key + DES_BLOCKLEN, Key + 2 * DES_BLOCKLEN, DES_BLOCKLEN)) {
        return  TRUE;
    }

    return  FALSE;
}


NTSTATUS
IPSecPopulateSA(
    IN  PSA_STRUCT              pSAStruct,
    IN  ULONG                   KeyLen,
    IN  PSA_TABLE_ENTRY         pSA
    )
/*++

Routine Description:

    Populates an SA with info passed in the SECURITY_ASSOCIATION block

Arguments:

    pSAInfo - information about the SA

    KeyLen - the length of the composite key (we do the slicing/dicing here)

    pSA - SA to be populated.

Return Value:

    STATUS_PENDING if the buffer is to be held on to, the normal case.

Notes:


--*/
{
    PSECURITY_ASSOCIATION    pSAInfo = &pSAStruct->SecAssoc[0];
    ULONG   Index;
    ULONG   len = 0;

    IPSEC_BUILD_SRC_DEST_ADDR(  pSA->sa_uliSrcDstAddr,
                                pSAStruct->InstantiatedFilter.SrcAddr,
                                pSAStruct->InstantiatedFilter.DestAddr);

    IPSEC_BUILD_SRC_DEST_MASK(  pSA->sa_uliSrcDstMask,
                                pSAStruct->InstantiatedFilter.SrcMask,
                                pSAStruct->InstantiatedFilter.DestMask);

    IPSEC_BUILD_PROTO_PORT_LI(  pSA->sa_uliProtoSrcDstPort,
                                pSAStruct->InstantiatedFilter.Protocol,
                                pSAStruct->InstantiatedFilter.SrcPort,
                                pSAStruct->InstantiatedFilter.DestPort);

    if ((pSAStruct->NumSAs < 1) ||
        (pSAStruct->NumSAs > MAX_SAS)) {
        IPSEC_DEBUG(SAAPI, ("Invalid NumOps count: %d\n", pSAStruct->NumSAs));
        return  STATUS_INVALID_PARAMETER;
    }

    //
    // If inbound SA, ensure that the last SPI is the one we returned.
    //
    if (!(pSA->sa_Flags & FLAGS_SA_OUTBOUND)) {
        if (pSA->sa_SPI != pSAStruct->SecAssoc[pSAStruct->NumSAs - 1].SPI) {
            IPSEC_DEBUG(SAAPI, ("SPI in invalid location: SPI: %lx, in loc: %lx\n",
                pSA->sa_SPI,
                pSAStruct->SecAssoc[pSAStruct->NumSAs - 1].SPI));
            return  STATUS_INVALID_PARAMETER;
        }
    }

    if (pSAStruct->Flags & IPSEC_SA_TUNNEL) {
        IPSEC_DEBUG(TUNNEL, ("SA %lx tunneled to %lx\n", pSA, pSAStruct->TunnelAddr));
        pSA->sa_TunnelAddr = pSAStruct->TunnelAddr;
        pSA->sa_Flags |= FLAGS_SA_TUNNEL;
    }

    if (pSAStruct->Flags & IPSEC_SA_DISABLE_IDLE_OUT) {
        pSA->sa_Flags |= FLAGS_SA_DISABLE_IDLE_OUT;
    }

    if (pSAStruct->Flags & IPSEC_SA_DISABLE_ANTI_REPLAY_CHECK) {
        pSA->sa_Flags |= FLAGS_SA_DISABLE_ANTI_REPLAY_CHECK;
    }

    if (pSAStruct->Flags & IPSEC_SA_DISABLE_LIFETIME_CHECK) {
        pSA->sa_Flags |= FLAGS_SA_DISABLE_LIFETIME_CHECK;
    }

    pSA->sa_NumOps = pSAStruct->NumSAs;
    pSA->sa_Lifetime = pSAStruct->Lifetime;
    pSA->sa_TruncatedLen = TRUNCATED_HASH_LEN;
    pSA->sa_ReplayLen = sizeof(ULONG);

    pSA->sa_QMPFSGroup = pSAStruct->dwQMPFSGroup;
    RtlCopyMemory(  &pSA->sa_CookiePair,
                    &pSAStruct->CookiePair,
                    sizeof(IKE_COOKIE_PAIR));

    for (Index = 0; Index < pSAStruct->NumSAs; Index++) {
        pSAInfo = &pSAStruct->SecAssoc[Index];
        pSA->sa_OtherSPIs[Index] = pSAInfo->SPI;
        pSA->sa_Operation[Index] = pSAInfo->Operation;
        pSA->sa_ReplaySendSeq[Index] = pSA->sa_ReplayStartPoint;
        pSA->sa_ReplayLastSeq[Index] = pSA->sa_ReplayStartPoint + 1;

        //
        // Now parse the Algorithm info..
        //
        switch (pSA->sa_Operation[Index]) {
            case None:
                IPSEC_DEBUG(ACQUIRE, ("NULL operation.\n"));
                if (pSA->sa_NumOps > 1) {
                    IPSEC_DEBUG(SAAPI, ("Invalid NumOps count; none specified, but more ops than 1\n"));
                    return  STATUS_INVALID_PARAMETER;
                }
                break;

            case Auth: {
                pSA->INT_ALGO(Index) = pSAInfo->EXT_INT_ALGO;

                if (pSA->INT_ALGO(Index) >= IPSEC_AH_MAX) {
                    IPSEC_DEBUG(SAAPI, ("Invalid int algo: %d %d\n", pSA->INT_ALGO(Index), IPSEC_AH_MAX));
                    return  STATUS_INVALID_PARAMETER;
                }

                pSA->INT_KEYLEN(Index) = pSAInfo->EXT_INT_KEYLEN;
                pSA->INT_ROUNDS(Index) = pSAInfo->EXT_INT_ROUNDS;

                //
                // Make sure the right key len was passed in
                //
                if (KeyLen > 0 && pSAInfo->EXT_INT_KEYLEN == (KeyLen - len)) {
                    IPSEC_DEBUG(SAAPI, ("Key len more than reserved, allocing new keys\n"));

                    if (!(pSA->INT_KEY(Index) = IPSecAllocateKeyBuffer(KeyLen))) {
                        return  STATUS_INSUFFICIENT_RESOURCES;
                    }

                    RtlCopyMemory(  pSA->INT_KEY(Index),
                                    (UCHAR UNALIGNED *)(pSAStruct->KeyMat + len),
                                    pSAInfo->EXT_INT_KEYLEN);
                } else {
                    //
                    // bogus - reject
                    //
                    IPSEC_DEBUG(SAAPI, ("AH: Key len is bogus - extra bytes: %d, keylen in struct: %d.\n",
                                            KeyLen-len,
                                            pSAInfo->EXT_INT_KEYLEN));

                    return  STATUS_INVALID_PARAMETER;
                }

                len = pSAInfo->EXT_INT_KEYLEN;

                break;
            }

            case Encrypt: {
                pSA->INT_ALGO(Index) = pSAInfo->EXT_INT_ALGO;

                if (pSA->INT_ALGO(Index) >= IPSEC_AH_MAX) {
                    IPSEC_DEBUG(SAAPI, ("Invalid int algo: %d %d\n", pSA->INT_ALGO(Index), IPSEC_AH_MAX));
                    return  STATUS_INVALID_PARAMETER;
                }

                if (pSA->INT_ALGO(Index) == IPSEC_AH_NONE) {
                    IPSEC_DEBUG(SAAPI, ("None Auth algo\n"));
                    //pSA->sa_TruncatedLen = 0;
                }

                pSA->INT_KEYLEN(Index) = pSAInfo->EXT_INT_KEYLEN;
                pSA->INT_ROUNDS(Index) = pSAInfo->EXT_INT_ROUNDS;

                pSA->CONF_ALGO(Index) = pSAInfo->EXT_CONF_ALGO;

                if (pSA->CONF_ALGO(Index) >= IPSEC_ESP_MAX) {
                    IPSEC_DEBUG(SAAPI, ("Invalid conf algo: %d %d\n", pSA->CONF_ALGO(Index), IPSEC_ESP_MAX));
                    return  STATUS_INVALID_PARAMETER;
                }

                if ((pSA->CONF_ALGO(Index) == IPSEC_ESP_DES) ||
                    (pSA->CONF_ALGO(Index) == IPSEC_ESP_3_DES) ||
                    (pSA->CONF_ALGO(Index) == IPSEC_ESP_NONE)) {
                    LARGE_INTEGER   Li;

                    NdisGetCurrentSystemTime(&Li);
                    pSA->sa_ivlen = DES_BLOCKLEN;

                    *(UNALIGNED ULONG *)&pSA->sa_iv[Index][0] = Li.LowPart;
                    *(UNALIGNED ULONG *)&pSA->sa_iv[Index][4] = Li.HighPart;
                    IPSecGenerateRandom((PUCHAR)&pSA->sa_iv[Index][0], DES_BLOCKLEN);

                    IPSEC_DEBUG(SAAPI, ("IV: %lx-%lx\n", *(PULONG)&pSA->sa_iv[Index][0], *(PULONG)&pSA->sa_iv[Index][4]));

                    pSA->CONF_KEYLEN(Index) = pSAInfo->EXT_CONF_KEYLEN;
                    pSA->CONF_ROUNDS(Index) = pSAInfo->EXT_CONF_ROUNDS;

                    //
                    // Make sure the right key len was passed in
                    //
                    if ((KeyLen-len == pSAStruct->KeyLen) &&
                        (pSAInfo->EXT_INT_KEYLEN + pSAInfo->EXT_CONF_KEYLEN <= KeyLen-len)) {

                        //
                        // confKeyMatLen is the amount of conf key material that came down.
                        // this is the reduced (weakened) length for export.
                        // it is expanded to the real length later.
                        //
                        ULONG   confKeyMatLen = pSAInfo->EXT_CONF_KEYLEN;
                        ULONG   realConfKeyLen = 0;

                        realConfKeyLen = confKeyMatLen;

                        if (pSA->CONF_ALGO(Index) == IPSEC_ESP_DES) {
                            if (pSAInfo->EXT_CONF_KEYLEN != DES_BLOCKLEN) {
                                ASSERT(FALSE);
                                IPSEC_DEBUG(SAAPI, ("Bad DES key length: pSAInfo->EXT_CONF_KEYLEN: %lx, conf: %lx, DES_BLOCKLEN: %lx\n",
                                                            pSAInfo->EXT_CONF_KEYLEN, confKeyMatLen, DES_BLOCKLEN));

                                return  STATUS_INVALID_PARAMETER;
                            }
                        } else if (pSA->CONF_ALGO(Index) == IPSEC_ESP_3_DES) {
                            if (pSAInfo->EXT_CONF_KEYLEN != 3 * DES_BLOCKLEN) {
                                ASSERT(FALSE);
                                IPSEC_DEBUG(SAAPI, ("Bad 3DES key length\n"));
                                return  STATUS_INVALID_PARAMETER;
                            }
                        }

                        IPSEC_DEBUG(SAAPI, ("Key len more than reserved, allocing new keys\n"));
                        if (pSAInfo->EXT_INT_KEYLEN > 0 &&
                            !(pSA->INT_KEY(Index) = IPSecAllocateKeyBuffer(pSAInfo->EXT_INT_KEYLEN))) {
                            return  STATUS_INSUFFICIENT_RESOURCES;
                        }

                        if (realConfKeyLen > 0 &&
                            !(pSA->CONF_KEY(Index) = IPSecAllocateKeyBuffer(realConfKeyLen))) {
                            if (pSA->INT_KEY(Index)) {
                                IPSecFreeKeyBuffer(pSA->INT_KEY(Index));
                                pSA->INT_KEY(Index) = NULL;
                            }
                            return  STATUS_INSUFFICIENT_RESOURCES;
                        }

                        if (pSA->CONF_KEY(Index) && confKeyMatLen) {
                            RtlCopyMemory(  pSA->CONF_KEY(Index),
                                            pSAStruct->KeyMat,
                                            confKeyMatLen);

                            if (confKeyMatLen < realConfKeyLen) {
                                if (pSA->INT_KEY(Index)) {
                                    IPSecFreeKeyBuffer(pSA->INT_KEY(Index));
                                    pSA->INT_KEY(Index) = NULL;
                                }
                                if (pSA->CONF_KEY(Index)) {
                                    IPSecFreeKeyBuffer(pSA->CONF_KEY(Index));
                                    pSA->CONF_KEY(Index) = NULL;
                                }
                                return  STATUS_INVALID_PARAMETER;
                            }

                            if ((pSA->CONF_ALGO(Index) == IPSEC_ESP_DES &&
                                 IPSecIsWeakDESKey(pSA->CONF_KEY(Index))) ||
                                (pSA->CONF_ALGO(Index) == IPSEC_ESP_3_DES &&
                                 IPSecIsWeak3DESKey(pSA->CONF_KEY(Index)))) {
                                PSA_TABLE_ENTRY pLarvalSA;

                                IPSEC_DEBUG(SAAPI, ("Got a weak key!!: %lx\n", pSA->CONF_KEY(Index)));
                                //
                                // if initiator, re-start a new negotiation and throw away this one
                                //
                                if (pSA->sa_Flags & FLAGS_SA_INITIATOR) {
                                    IPSecNegotiateSA(   pSA->sa_Filter,
                                                        pSA->sa_uliSrcDstAddr,
                                                        pSA->sa_uliProtoSrcDstPort,
                                                        pSA->sa_NewMTU,
                                                        &pLarvalSA,
                                                        pSA->sa_DestType);
                                    IPSecQueuePacket(pLarvalSA, pSA->sa_BlockedBuffer);
                                }

                                return  STATUS_INVALID_PARAMETER;
                            }
                        } else {
                            if (pSA->CONF_ALGO(Index) != IPSEC_ESP_NONE) {
                                IPSEC_DEBUG(SAAPI, ("Algo: %lx with no keymat!!: %lx\n", pSA->CONF_ALGO(Index)));
                                ASSERT(FALSE);
                                return  STATUS_INVALID_PARAMETER;
                            }
                            pSA->sa_ivlen = 0;
                        }

                        if (pSAInfo->EXT_INT_KEYLEN > 0) {
                            RtlCopyMemory(  pSA->INT_KEY(Index),
                                            (UCHAR UNALIGNED *)(pSAStruct->KeyMat + pSAInfo->EXT_CONF_KEYLEN),
                                            pSAInfo->EXT_INT_KEYLEN);
                        }

                        len = pSAInfo->EXT_CONF_KEYLEN + pSAInfo->EXT_INT_KEYLEN;
                    } else {
                        //
                        // bogus - reject
                        //
                        IPSEC_DEBUG(SAAPI, ("ESP: Key len is bogus - extra bytes: %lx, keylen in struct: %lx.\n",
                                                KeyLen-len,
                                                pSAInfo->EXT_INT_KEYLEN + pSAInfo->EXT_CONF_KEYLEN));

                        return  STATUS_INVALID_PARAMETER;
                    }
                }

                break;
            }

            default:
                IPSEC_DEBUG(SAAPI, ("IPSecPopulateSA: Bad operation\n"));
                break;
        }
    }
    return  STATUS_SUCCESS;
}


NTSTATUS
IPSecCreateSA(
    OUT PSA_TABLE_ENTRY         *ppSA
    )
/*++

Routine Description:

    Creates a Security Association block.

Arguments:

    ppSA - returns the SA pointer

Return Value:

    STATUS_PENDING if the buffer is to be held on to, the normal case.

Notes:


--*/
{
    PSA_TABLE_ENTRY  pSA;

    IPSEC_DEBUG(SAAPI, ("Entering IPSecCreateSA\n"));

    pSA = IPSecAllocateMemory(sizeof(SA_TABLE_ENTRY), IPSEC_TAG_SA);

    if (!pSA) {
        return  STATUS_INSUFFICIENT_RESOURCES;
    }

    IPSecZeroMemory(pSA, sizeof(SA_TABLE_ENTRY));
    pSA->sa_Signature = IPSEC_SA_SIGNATURE;
    pSA->sa_NewMTU = MAX_LONG;

#if DBG
    pSA->sa_d1 = IPSEC_SA_D_1;
    pSA->sa_d2 = IPSEC_SA_D_2;
    pSA->sa_d3 = IPSEC_SA_D_3;
    pSA->sa_d4 = IPSEC_SA_D_4;
#endif

    INIT_LOCK(&pSA->sa_Lock);

    InitializeListHead(&pSA->sa_SPILinkage);
    InitializeListHead(&pSA->sa_FilterLinkage);
    InitializeListHead(&pSA->sa_LarvalLinkage);
    InitializeListHead(&pSA->sa_PendingLinkage);

    pSA->sa_Reference = 1;
    pSA->sa_State = STATE_SA_CREATED;
    pSA->sa_ExpiryTime = IPSEC_SA_EXPIRY_TIME;

    *ppSA = pSA;
    return  STATUS_SUCCESS;
}


PSA_TABLE_ENTRY
IPSecLookupSABySPI(
    IN  tSPI    SPI,
    IN  IPAddr  DestAddr
    )
/*++

Routine Description:

    Looks up the SA given the SPI and Filter variables.

Arguments:


Return Value:


Notes:

--*/
{
    KIRQL           kIrql;
    PSA_TABLE_ENTRY pSA;

    AcquireReadLock(&g_ipsec.SPIListLock, &kIrql);
    pSA = IPSecLookupSABySPIWithLock(SPI, DestAddr);
    ReleaseReadLock(&g_ipsec.SPIListLock, kIrql);
    return pSA;
}


PSA_TABLE_ENTRY
IPSecLookupSABySPIWithLock(
    IN  tSPI    SPI,
    IN  IPAddr  DestAddr
    )
/*++

Routine Description:

    Looks up the SA given the SPI and Filter variables.

    NOTE: Always call with the SPIListLock held.

Arguments:


Return Value:


Notes:

--*/
{
    PSA_HASH        pHash;
    PLIST_ENTRY     pEntry;
    PSA_TABLE_ENTRY pSA;

    //
    // get to hash bucket
    //
    IPSEC_HASH_SPI(DestAddr, SPI, pHash);

    //
    // search for specific entry in collision chain
    //
    for (   pEntry = pHash->SAList.Flink;
            pEntry != &pHash->SAList;
            pEntry = pEntry->Flink) {

        pSA = CONTAINING_RECORD(pEntry,
                                SA_TABLE_ENTRY,
                                sa_SPILinkage);

        if (pSA->sa_TunnelAddr) {
            if ((DestAddr == pSA->sa_TunnelAddr) &&
                (pSA->sa_SPI == SPI)) {
                IPSEC_DEBUG(HASH, ("Matched Tunnel entry: %lx\n", pSA));

                return  pSA;
            }
        } else {
            if ((DestAddr == pSA->SA_DEST_ADDR) &&
                (pSA->sa_SPI == SPI)) {

                IPSEC_DEBUG(HASH, ("Matched entry: %lx\n", pSA));
                return  pSA;
            }
        }
    }

    //
    // no entry found
    //
    return NULL;
}


NTSTATUS
IPSecLookupSAByAddr(
    IN  ULARGE_INTEGER  uliSrcDstAddr,
    IN  ULARGE_INTEGER  uliProtoSrcDstPort,
    OUT PFILTER         *ppFilter,
    OUT PSA_TABLE_ENTRY *ppSA,
    OUT PSA_TABLE_ENTRY *ppNextSA,
    OUT PSA_TABLE_ENTRY *ppTunnelSA,
    IN  BOOLEAN         fOutbound,
    IN  BOOLEAN         fFWPacket,
    IN  BOOLEAN         fBypass
    )
/*++

Routine Description:

    Looks up the SA given the relevant addresses.

Arguments:

    uliSrcDstAddr - src/dest IP addr
    uliProtoSrcDstPort - protocol, src/dest port
    ppFilter - filter found
    ppSA - SA found
    ppTunnelSA - tunnel SA found
    fOutbound - direction flag

Return Value:

    STATUS_SUCCESS - both filter and SA found
    STATUS_UNSUCCESSFUL - none found
    STATUS_PENDING - filter found, but no SA

Notes:

    Called with SADBLock held.

--*/
{
    PFILTER                 pFilter;
    PLIST_ENTRY             pEntry;
    PLIST_ENTRY             pFilterList;
    PLIST_ENTRY             pSAChain;
    PSA_TABLE_ENTRY         pSA;
    REGISTER ULARGE_INTEGER uliPort;
    REGISTER ULARGE_INTEGER uliAddr;
    BOOLEAN                 fFound = FALSE;

    *ppSA = NULL;
    *ppFilter = NULL;
    *ppTunnelSA = NULL;

    //
    // Search in Tunnel filters list
    //
    pFilterList = IPSecResolveFilterList(TRUE, fOutbound);

    for (   pEntry = pFilterList->Flink;
            pEntry != pFilterList;
            pEntry = pEntry->Flink) {

        pFilter = CONTAINING_RECORD(pEntry,
                                    FILTER,
                                    MaskedLinkage);

        if (fBypass && IS_EXEMPT_FILTER(pFilter)) {
            //
            // Don't search block/pass-thru filters for host bypass traffic
            //
            continue;
        }

        uliAddr.QuadPart = uliSrcDstAddr.QuadPart & pFilter->uliSrcDstMask.QuadPart;
        uliPort.QuadPart = uliProtoSrcDstPort.QuadPart & pFilter->uliProtoSrcDstMask.QuadPart;

        if ((uliAddr.QuadPart == pFilter->uliSrcDstAddr.QuadPart) &&
            (uliPort.QuadPart == pFilter->uliProtoSrcDstPort.QuadPart)) {
            IPSEC_DEBUG(HASH, ("Matched entry: %lx\n", pFilter));

            fFound = TRUE;
            break;
        }
    }

    if (fFound) {
        fFound = FALSE;
        //
        // Search for the particular SA now.
        //
        pSAChain = IPSecResolveSAChain(pFilter, fOutbound? DEST_ADDR: SRC_ADDR);

        for (   pEntry = pSAChain->Flink;
                pEntry != pSAChain;
                pEntry = pEntry->Flink) {

            pSA = CONTAINING_RECORD(pEntry,
                                    SA_TABLE_ENTRY,
                                    sa_FilterLinkage);

            ASSERT(pSA->sa_Flags & FLAGS_SA_TUNNEL);

            if (pFilter->TunnelAddr != 0) {
                //
                // match the outbound flag also
                //
                IPSEC_DEBUG(HASH, ("Matched specific tunnel entry: %lx\n", pSA));
                ASSERT(fOutbound == (BOOLEAN)((pSA->sa_Flags & FLAGS_SA_OUTBOUND) != 0));
                fFound = TRUE;
                *ppTunnelSA = pSA;
                break;
            }
        }

        if (fFound) {
            fFound = FALSE;
            *ppFilter = pFilter;
        } else {
            //
            // Found a filter entry, but need to negotiate keys
            //
            *ppFilter = pFilter;
            return  STATUS_PENDING;
        }
    }

    //
    // Search in Masked filters list
    //
    pFilterList = IPSecResolveFilterList(FALSE, fOutbound);

    for (   pEntry = pFilterList->Flink;
            pEntry != pFilterList;
            pEntry = pEntry->Flink) {

        pFilter = CONTAINING_RECORD(pEntry,
                                    FILTER,
                                    MaskedLinkage);

        if (fFWPacket && !IS_EXEMPT_FILTER(pFilter)) {
            //
            // Search only block/pass-thru filters in forward path
            //
            continue;
        }

        if (fBypass && IS_EXEMPT_FILTER(pFilter)) {
            //
            // Don't search block/pass-thru filters for host bypass traffic
            //
            continue;
        }

        uliAddr.QuadPart = uliSrcDstAddr.QuadPart & pFilter->uliSrcDstMask.QuadPart;
        uliPort.QuadPart = uliProtoSrcDstPort.QuadPart & pFilter->uliProtoSrcDstMask.QuadPart;

        if ((uliAddr.QuadPart == pFilter->uliSrcDstAddr.QuadPart) &&
            (uliPort.QuadPart == pFilter->uliProtoSrcDstPort.QuadPart)) {
            IPSEC_DEBUG(HASH, ("Matched entry: %lx\n", pFilter));

            fFound = TRUE;
            break;
        }
    }

    if (fFound) {
        //
        // Search for the particular SA now.
        //
        fFound=FALSE;
        pSAChain = IPSecResolveSAChain(pFilter, fOutbound? DEST_ADDR: SRC_ADDR);

        for (   pEntry = pSAChain->Flink;
                pEntry != pSAChain;
                pEntry = pEntry->Flink) {

            pSA = CONTAINING_RECORD(pEntry,
                                    SA_TABLE_ENTRY,
                                    sa_FilterLinkage);
            
            if (IS_CLASSD(NET_LONG(pSA->SA_SRC_ADDR))
                || IS_CLASSD(NET_LONG(pSA->SA_DEST_ADDR))) {
                uliAddr.QuadPart = uliSrcDstAddr.QuadPart & pSA->sa_uliSrcDstMask.QuadPart;
                
                IPSEC_DEBUG(HASH, ("MCAST: %d %d %d %d", uliAddr.LowPart, uliAddr.HighPart,
                            pSA->sa_uliSrcDstAddr.LowPart,pSA->sa_uliSrcDstAddr.HighPart));

                if (uliAddr.QuadPart == pSA->sa_uliSrcDstAddr.QuadPart) {
                    fFound=TRUE;
                }
            } else if (uliSrcDstAddr.QuadPart == pSA->sa_uliSrcDstAddr.QuadPart) {
                fFound=TRUE;
            }
            if (fFound) {
                IPSEC_DEBUG(HASH, ("Matched entry: %lx\n", pSA));
                ASSERT(fOutbound == (BOOLEAN)((pSA->sa_Flags & FLAGS_SA_OUTBOUND) != 0));

                //
                // if there is also a tunnel SA, associate it here.
                //
                if (*ppTunnelSA && fOutbound) {
                    *ppNextSA = *ppTunnelSA;
                    IPSEC_DEBUG(SAAPI, ("linked next sa: %lx, next: %lx", pSA, *ppTunnelSA));
                    *ppTunnelSA = NULL;
                }

                *ppFilter = pFilter;
                *ppSA = pSA;
                return  STATUS_SUCCESS;
            }
        }

        //
        // Found a filter entry, but need to negotiate keys
        //
        // Also, ppTunnelSA is set to the proper tunnel SA we need
        // to hook to this end-2-end SA once it is negotiated.
        //
        *ppFilter = pFilter;

        return  STATUS_PENDING;
    } else {
        //
        // if only tunnel SA found, return that as the SA
        // found.
        //
        if (*ppTunnelSA) {
            *ppSA = *ppTunnelSA;
            *ppTunnelSA = NULL;
            return  STATUS_SUCCESS;
        }
    }

    //
    // no entry found
    //
    return  STATUS_NOT_FOUND;
}


NTSTATUS
IPSecLookupTunnelSA(
    IN  ULARGE_INTEGER  uliSrcDstAddr,
    IN  ULARGE_INTEGER  uliProtoSrcDstPort,
    OUT PFILTER         *ppFilter,
    OUT PSA_TABLE_ENTRY *ppSA,
    IN  BOOLEAN         fOutbound
    )
/*++

Routine Description:

    Looks up the SA given the relevant addresses.

Arguments:

    uliSrcDstAddr - src/dest IP addr
    uliProtoSrcDstPort - protocol, src/dest port
    ppFilter - filter found
    ppSA - SA found
    fOutbound - direction flag

Return Value:

    STATUS_SUCCESS - both filter and SA found
    STATUS_UNSUCCESSFUL - none found
    STATUS_PENDING - filter found, but no SA

Notes:

    Called with SADBLock held.

--*/
{
    PFILTER                 pFilter;
    PLIST_ENTRY             pEntry;
    PLIST_ENTRY             pFilterList;
    PLIST_ENTRY             pSAChain;
    PSA_TABLE_ENTRY         pSA;
    REGISTER ULARGE_INTEGER uliPort;
    REGISTER ULARGE_INTEGER uliAddr;
    BOOLEAN                 fFound = FALSE;

    *ppSA = NULL;
    *ppFilter = NULL;

    //
    // Search in Tunnel filters list
    //
    pFilterList = IPSecResolveFilterList(TRUE, fOutbound);

    for (   pEntry = pFilterList->Flink;
            pEntry != pFilterList;
            pEntry = pEntry->Flink) {

        pFilter = CONTAINING_RECORD(pEntry,
                                    FILTER,
                                    MaskedLinkage);

        uliAddr.QuadPart = uliSrcDstAddr.QuadPart & pFilter->uliSrcDstMask.QuadPart;
        uliPort.QuadPart = uliProtoSrcDstPort.QuadPart & pFilter->uliProtoSrcDstMask.QuadPart;

        if ((uliAddr.QuadPart == pFilter->uliSrcDstAddr.QuadPart) &&
            (uliPort.QuadPart == pFilter->uliProtoSrcDstPort.QuadPart)) {

            IPSEC_DEBUG(HASH, ("Matched entry: %lx\n", pFilter));
            fFound = TRUE;
            break;
        }
    }

    if (fFound) {
        //
        // Search for the particular SA now.
        //
        pSAChain = IPSecResolveSAChain(pFilter, fOutbound? DEST_ADDR: SRC_ADDR);

        for (   pEntry = pSAChain->Flink;
                pEntry != pSAChain;
                pEntry = pEntry->Flink) {

            pSA = CONTAINING_RECORD(pEntry,
                                    SA_TABLE_ENTRY,
                                    sa_FilterLinkage);

            ASSERT(pSA->sa_Flags & FLAGS_SA_TUNNEL);

            if (pFilter->TunnelAddr != 0) {
                //
                // match the outbound flag also
                //
                IPSEC_DEBUG(HASH, ("Matched specific tunnel entry: %lx\n", pSA));
                ASSERT(fOutbound == (BOOLEAN)((pSA->sa_Flags & FLAGS_SA_OUTBOUND) != 0));
                *ppFilter = pFilter;
                *ppSA = pSA;
                return  STATUS_SUCCESS;
            }
        }

        //
        // Found a filter entry, but need to negotiate keys
        //
        *ppFilter = pFilter;
        return  STATUS_PENDING;
    }

    //
    // no entry found
    //
    return  STATUS_NOT_FOUND;
}


NTSTATUS
IPSecLookupMaskedSA(
    IN  ULARGE_INTEGER  uliSrcDstAddr,
    IN  ULARGE_INTEGER  uliProtoSrcDstPort,
    OUT PFILTER         *ppFilter,
    OUT PSA_TABLE_ENTRY *ppSA,
    IN  BOOLEAN         fOutbound
    )
/*++

Routine Description:

    Looks up the SA given the relevant addresses.

Arguments:

    uliSrcDstAddr - src/dest IP addr
    uliProtoSrcDstPort - protocol, src/dest port
    ppFilter - filter found
    ppSA - SA found
    fOutbound - direction flag

Return Value:

    STATUS_SUCCESS - both filter and SA found
    STATUS_UNSUCCESSFUL - none found
    STATUS_PENDING - filter found, but no SA

Notes:

    Called with SADBLock held.

--*/
{
    PFILTER                 pFilter;
    PLIST_ENTRY             pEntry;
    PLIST_ENTRY             pFilterList;
    PLIST_ENTRY             pSAChain;
    PSA_TABLE_ENTRY         pSA;
    REGISTER ULARGE_INTEGER uliPort;
    REGISTER ULARGE_INTEGER uliAddr;
    BOOLEAN                 fFound = FALSE;

    *ppSA = NULL;
    *ppFilter = NULL;

    //
    // Search in Masked filters list
    //
    pFilterList = IPSecResolveFilterList(FALSE, fOutbound);

    for (   pEntry = pFilterList->Flink;
            pEntry != pFilterList;
            pEntry = pEntry->Flink) {

        pFilter = CONTAINING_RECORD(pEntry,
                                    FILTER,
                                    MaskedLinkage);

        uliAddr.QuadPart = uliSrcDstAddr.QuadPart & pFilter->uliSrcDstMask.QuadPart;
        uliPort.QuadPart = uliProtoSrcDstPort.QuadPart & pFilter->uliProtoSrcDstMask.QuadPart;

        if ((uliAddr.QuadPart == pFilter->uliSrcDstAddr.QuadPart) &&
            (uliPort.QuadPart == pFilter->uliProtoSrcDstPort.QuadPart)) {

            IPSEC_DEBUG(HASH, ("Matched entry: %lx\n", pFilter));
            fFound = TRUE;
            break;
        }
    }

    if (fFound) {
        //
        // Search for the particular SA now.
        //
        pSAChain = IPSecResolveSAChain(pFilter, fOutbound? DEST_ADDR: SRC_ADDR);

        for (   pEntry = pSAChain->Flink;
                pEntry != pSAChain;
                pEntry = pEntry->Flink) {

            pSA = CONTAINING_RECORD(pEntry,
                                    SA_TABLE_ENTRY,
                                    sa_FilterLinkage);

            if (uliSrcDstAddr.QuadPart == pSA->sa_uliSrcDstAddr.QuadPart) {
                IPSEC_DEBUG(HASH, ("Matched entry: %lx\n", pSA));
                ASSERT(fOutbound == (BOOLEAN)((pSA->sa_Flags & FLAGS_SA_OUTBOUND) != 0));
                *ppFilter = pFilter;
                *ppSA = pSA;
                return  STATUS_SUCCESS;
            }
        }

        //
        // Found a filter entry, but need to negotiate keys
        //
        *ppFilter = pFilter;
        return  STATUS_PENDING;
    }

    //
    // no entry found
    //
    return  STATUS_NOT_FOUND;
}


NTSTATUS
IPSecAllocateSPI(
    OUT tSPI            * pSpi,
    IN  PSA_TABLE_ENTRY   pSA
    )
/*++

Routine Description:

    Allocates an SPI for an incoming SA - guards against collisions

Arguments:

    pSpi - the SPI allocated is filled in here

    pSA - SA for which SPI is needed

Return Value:


Notes:

--*/
{
    ULONG   rand;
    ULONG   numRetries = 0;
    IPAddr  DestAddr;

    if (pSA->sa_TunnelAddr) {
        DestAddr = pSA->sa_TunnelAddr;
    } else {
        DestAddr = pSA->SA_DEST_ADDR;
    }

    //
    // if SPI passed in, use that spi else allocate one.
    //
    if (*pSpi) {
        if (IPSecLookupSABySPIWithLock(
                                *pSpi,
                                DestAddr)) {
            return STATUS_UNSUCCESSFUL;
        } else {
            return STATUS_SUCCESS;
        }
    } else {
        rand = (ULONG)(ULONG_PTR)pSA;
        IPSecGenerateRandom((PUCHAR)&rand, sizeof(ULONG));
        rand = LOWER_BOUND_SPI + rand % (UPPER_BOUND_SPI - LOWER_BOUND_SPI);

        while (numRetries++ < MAX_SPI_RETRIES) {

            if (!IPSecLookupSABySPIWithLock(
                                    (tSPI)rand,
                                    DestAddr)) {
                *pSpi = (tSPI)rand;
                return STATUS_SUCCESS;
            }

            rand++;

            //
            // Collision, retry
            //
            IPSEC_DEBUG(ACQUIRE, ("IPSecAllocateSPI: collision for: %lx\n", rand));
        }
    }

    return STATUS_UNSUCCESSFUL;
}


NTSTATUS
IPSecNegotiateSA(
    IN  PFILTER         pFilter,
    IN  ULARGE_INTEGER  uliSrcDstAddr,
    IN  ULARGE_INTEGER  uliProtoSrcDstPort,
    IN  ULONG           NewMTU,
    OUT PSA_TABLE_ENTRY *ppSA,
    IN  UCHAR           DestType
    )
/*++

Routine Description:

    Allocates a Larval Inbound SA block then kicks off key manager to negotiate
    the algorithms/keys.

    Called with SADB lock held, returns with it.

Arguments:

    pFilter - the filter and policy that matched this packet.

    ppSA - returns the SA created here.

Return Value:

    STATUS_PENDING if the buffer is to be held on to, the normal case.

Notes:


--*/
{
    KIRQL	        kIrql;
    KIRQL	        OldIrq;
    NTSTATUS        status;
    PSA_TABLE_ENTRY pSA;

    //
    // Make sure we dont already have this SA under negotiation
    // walk the LarvalSA list to see if we can find another SA.
    //
    pSA = IPSecLookupSAInLarval(uliSrcDstAddr, uliProtoSrcDstPort);
    if (pSA != NULL) {
        IPSEC_DEBUG(PATTERN, ("Found in Larval: %lx\n", pSA));
        *ppSA = pSA;
        return  STATUS_DUPLICATE_OBJECTID;
    }

    IPSEC_DEBUG(ACQUIRE, ("IPSecNegotiateSA: SA: %lx, DA: %lx, P: %lx, SP: %lx, DP: %lx\n", SRC_ADDR, DEST_ADDR, PROTO, SRC_PORT, DEST_PORT));

    //
    // Initiator
    //
    status = IPSecInitiatorCreateLarvalSA(
                 pFilter, 
                 uliSrcDstAddr,
                 ppSA,
                 DestType
                 );

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(SAAPI, ("IPSecNegotiateSA: IPSecCreateSA failed: %lx\n", status));
        return status;
    }

    //
    // Save the NewMTU value if this SA has been PMTU'd.
    //
    (*ppSA)->sa_NewMTU = NewMTU;

    //
    // If this is a tunnel filter to be negotiated, save off the tunnel addr in the
    // SA.
    //
    if (pFilter->TunnelFilter) {
        IPSEC_DEBUG(TUNNEL, ("Negotiating tunnel SA: %lx\n", (*ppSA)));
        // (*ppSA)->sa_TunnelAddr = pFilter->TunnelAddr;
    }

    //
    // Now send this up to the Key Manager to negotiate the keys
    //
    ACQUIRE_LOCK(&g_ipsec.AcquireInfo.Lock, &OldIrq);
    status = IPSecSubmitAcquire(*ppSA, OldIrq, FALSE);

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(SAAPI, ("IPSecNegotiateSA: IPSecSubmitAcquire failed: %lx\n", status));

        ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &kIrql);
        IPSecRemoveEntryList(&(*ppSA)->sa_LarvalLinkage);
        IPSEC_DEC_STATISTIC(dwNumPendingKeyOps);
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);

        AcquireWriteLock(&g_ipsec.SPIListLock, &kIrql);
        IPSecRemoveSPIEntry(*ppSA);
        ReleaseWriteLock(&g_ipsec.SPIListLock, kIrql);

        //
        // also remove from the filter list
        //
        if ((*ppSA)->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
            (*ppSA)->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
            IPSecRemoveEntryList(&(*ppSA)->sa_FilterLinkage);
            (*ppSA)->sa_Filter = NULL;
        }

        if ((*ppSA)->sa_RekeyOriginalSA) {
            ASSERT((*ppSA)->sa_Flags & FLAGS_SA_REKEY);
            ASSERT((*ppSA)->sa_RekeyOriginalSA->sa_RekeyLarvalSA == (*ppSA));
            ASSERT((*ppSA)->sa_RekeyOriginalSA->sa_Flags & FLAGS_SA_REKEY_ORI);

            (*ppSA)->sa_RekeyOriginalSA->sa_Flags &= ~FLAGS_SA_REKEY_ORI;
            (*ppSA)->sa_RekeyOriginalSA->sa_RekeyLarvalSA = NULL;
            (*ppSA)->sa_RekeyOriginalSA = NULL;
        }

        (*ppSA)->sa_Flags &= ~FLAGS_SA_TIMER_STARTED;
        IPSecStopTimer(&(*ppSA)->sa_Timer);
        IPSecDerefSA(*ppSA);
        return status;
    }

    return status;
}


VOID
IPSecFlushQueuedPackets(
    IN  PSA_TABLE_ENTRY         pSA,
    IN  NTSTATUS                status
    )
/*++

Routine Description:

    Flushes queued packets now that the keys are known

Arguments:


Return Value:


Notes:

--*/
{
    PIPSEC_SEND_COMPLETE_CONTEXT pContext;
    IPOptInfo       optInfo;
    ULONG           len;
    PNDIS_BUFFER    pHdrMdl;
    ULONG           dataLen;
    IPHeader UNALIGNED * pIPH;
    KIRQL	        kIrql;

    //
    // We need to acquire a lock here because this routine can be called in
    // parallel with one in SA delete and the other in SA update (normal).
    //
    ACQUIRE_LOCK(&pSA->sa_Lock, &kIrql);
    pHdrMdl = pSA->sa_BlockedBuffer;
    dataLen = pSA->sa_BlockedDataLen;

    pSA->sa_BlockedBuffer = NULL;
    pSA->sa_BlockedDataLen = 0;
    RELEASE_LOCK(&pSA->sa_Lock, kIrql);

    if (!pHdrMdl) {
        IPSEC_DEBUG(ACQUIRE, ("FlushQueuedPackets: pHdrMdl == NULL\n"));
        return;
    }

    if (status == STATUS_SUCCESS) {
        ASSERT(pSA->sa_State == STATE_SA_ACTIVE);
        ASSERT((pSA->sa_Flags & FLAGS_SA_OUTBOUND) == 0);
        ASSERT(pHdrMdl);

        pContext = IPSecAllocateSendCompleteCtx(IPSEC_TAG_ESP);

        if (!pContext) {
            PNDIS_BUFFER    pNextMdl;
            PNDIS_BUFFER    pMdl = pHdrMdl;
            NTSTATUS        status;

            IPSEC_DEBUG(ESP, ("Failed to alloc. SendCtx\n"));

            ASSERT(pMdl);

            while (pMdl) {
                pNextMdl = NDIS_BUFFER_LINKAGE(pMdl);
                IPSecFreeBuffer(&status, pMdl);
                pMdl = pNextMdl;
            }

            return;
        }

        IPSEC_INCREMENT(g_ipsec.NumSends);

        IPSecZeroMemory(pContext, sizeof(IPSEC_SEND_COMPLETE_CONTEXT));

#if DBG
        RtlCopyMemory(pContext->Signature, "ISC6", 4);
#endif

        pContext->FlushMdl = pHdrMdl;
        pContext->Flags |= SCF_FLUSH;

        IPSecQueryNdisBuf(pHdrMdl, (PVOID)&pIPH, &len);

        //
        // Call IPTransmit with proper Protocol type so it takes this packet
        // at *face* value.
        //
        optInfo = g_ipsec.OptInfo;
        optInfo.ioi_flags |= IP_FLAG_IPSEC;
        status = TCPIP_IP_TRANSMIT( &g_ipsec.IPProtInfo,
                                    pContext,
                                    pHdrMdl,
                                    dataLen,
                                    pIPH->iph_dest,
                                    pIPH->iph_src,
                                    &optInfo,
                                    NULL,
                                    pIPH->iph_protocol,
                                    NULL);

        //
        // Even in the synchronous case, we free the MDL chain in ProtocolSendComplete
        // (called by IPSecSendComplete). So, we dont call anything here.
        // See IPSecReinjectPacket.
        //
    } else {
        PNDIS_BUFFER    pNextMdl;
        PNDIS_BUFFER    pMdl = pHdrMdl;
        NTSTATUS        status;

        ASSERT(pMdl);

        while (pMdl) {
            pNextMdl = NDIS_BUFFER_LINKAGE(pMdl);
            IPSecFreeBuffer(&status, pMdl);
            pMdl = pNextMdl;
        }
    }

    return;
}


NTSTATUS
IPSecInsertOutboundSA(
    IN  PSA_TABLE_ENTRY         pSA,
    IN  PIPSEC_ACQUIRE_CONTEXT  pAcquireCtx,
    IN  BOOLEAN                 fTunnelFilter
    )
/*++

Routine Description:

    Adds an SA into the database, typically called to add outbound SAs as a
    result of successful negotiation of keys corresponding to the inbound SA
    specified in the context that comes down.

    NOTE: Called with SADB lock held.

Arguments:

    pSA - SA to be inserted

    pAcquireContext - The Acquire context

Return Value:


Notes:

--*/
{
    PSA_TABLE_ENTRY pInboundSA = pAcquireCtx->pSA;
    PSA_TABLE_ENTRY pAssociatedSA;
    KIRQL	        kIrql;
    KIRQL	        kIrql1;
    NTSTATUS        status;
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pOutboundSA = NULL;
    PSA_TABLE_ENTRY pTunnelSA = NULL;
    PLIST_ENTRY     pSAChain;

    ASSERT(pSA->sa_Flags & FLAGS_SA_OUTBOUND);
    ASSERT((pInboundSA->sa_Flags & FLAGS_SA_OUTBOUND) == 0);
    ASSERT(pInboundSA->sa_State == STATE_SA_LARVAL);

    //
    // Potential dangling pointer, always go through the lookup path.
    //
    if (fTunnelFilter) {
        status = IPSecLookupTunnelSA(   pSA->sa_uliSrcDstAddr,
                                        pSA->sa_uliProtoSrcDstPort,
                                        &pFilter,
                                        &pOutboundSA,
                                        TRUE);
    } else {
#if GPC
        if (IS_GPC_ACTIVE()) {
            status = IPSecLookupGpcMaskedSA(pSA->sa_uliSrcDstAddr,
                                            pSA->sa_uliProtoSrcDstPort,
                                            &pFilter,
                                            &pOutboundSA,
                                            TRUE);
        } else {
            status = IPSecLookupMaskedSA(   pSA->sa_uliSrcDstAddr,
                                            pSA->sa_uliProtoSrcDstPort,
                                            &pFilter,
                                            &pOutboundSA,
                                            TRUE);
        }
#else
        status = IPSecLookupMaskedSA(   pSA->sa_uliSrcDstAddr,
                                        pSA->sa_uliProtoSrcDstPort,
                                        &pFilter,
                                        &pOutboundSA,
                                        TRUE);
#endif
    }

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(ACQUIRE, ("IPSecInsertOutboundSA: IPSecLookupSAByAddr failed: %lx\n", status));
        return status;
    }

    pSAChain = IPSecResolveSAChain(pFilter, pSA->SA_DEST_ADDR);

    if (status == STATUS_SUCCESS) {
        //
        // re-negotiate case: delete the outbound; expire the inbound; add the new one.
        //
        IPSEC_DEBUG(ACQUIRE, ("IPSecInsertOutboundSA: found another: %lx\n", pOutboundSA));
        ASSERT(pOutboundSA);
        ASSERT(pOutboundSA->sa_Flags & FLAGS_SA_OUTBOUND);

        pSA->sa_Filter = pFilter;
        pSA->sa_Flags |= FLAGS_SA_ON_FILTER_LIST;
        InsertHeadList(pSAChain, &pSA->sa_FilterLinkage);

        IPSEC_INC_STATISTIC(dwNumReKeys);

        pAssociatedSA = pOutboundSA->sa_AssociatedSA;
        if (pAssociatedSA &&
            ((pOutboundSA->sa_Flags & FLAGS_SA_REKEY_ORI) ||
             !(pInboundSA->sa_Filter))) {
            IPSecExpireInboundSA(pAssociatedSA);
        }
    } else {
        //
        // pending => this will be the add.
        //
        ASSERT(pOutboundSA == NULL);
        pSA->sa_Filter = pFilter;
        pSA->sa_Flags |= FLAGS_SA_ON_FILTER_LIST;
        InsertHeadList(pSAChain, &pSA->sa_FilterLinkage);
    }

    if (pFilter->TunnelAddr != 0) {
        pSA->sa_Flags |= FLAGS_SA_TUNNEL;
        pSA->sa_TunnelAddr = pFilter->TunnelAddr;
    }

    //
    // Initiator if the original SA had a filter pointer.
    //
    if (pInboundSA->sa_Filter) {
        pSA->sa_Flags |= FLAGS_SA_INITIATOR;
    }

    //
    // Flush this filter from cache table so we match the SA next.
    //
    if (IS_EXEMPT_FILTER(pFilter)) {
        IPSecInvalidateFilterCacheEntry(pFilter);
    }

    return  STATUS_SUCCESS;
}


NTSTATUS
IPSecAddSA(
    IN  PIPSEC_ADD_SA   pAddSA,
    IN  ULONG           TotalSize
    )
/*++

Routine Description:

    Adds an SA into the database, typically called to add outbound SAs as a
    result of successful negotiation of keys corresponding to the inbound SA
    specified in the context that comes down.

Arguments:

    pAddSA - Add SA context and info.

    TotalSize - the total size of the input buffer.

Return Value:


Notes:


--*/
{
    NTSTATUS        status = STATUS_SUCCESS;
    PSA_STRUCT      saInfo = &pAddSA->SAInfo;
    PSA_TABLE_ENTRY pSA;
    ULONG           keyLen = 0;
    PSA_TABLE_ENTRY pInboundSA;
    KIRQL	        kIrql;
    KIRQL	        kIrql1;
    PIPSEC_ACQUIRE_CONTEXT  pAcquireContext = (PIPSEC_ACQUIRE_CONTEXT)(saInfo->Context);

    //
    // Lock the larval list so this SA does not go away.
    //
    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql1);
    ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &kIrql);

    //
    // Sanity check the incoming context to see if it is actually
    // an SA block
    //
    if (!NT_SUCCESS(IPSecValidateHandle(pAcquireContext, STATE_SA_LARVAL))) {
        IPSEC_DEBUG(SAAPI, ("IPSecAddSA: invalid context: %lx\n", pAcquireContext));
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
        return  STATUS_INVALID_PARAMETER;
    }

    //
    // figure out the key length and pass that in
    //
    keyLen = TotalSize - IPSEC_ADD_SA_NO_KEY_SIZE;
    IPSEC_DEBUG(SAAPI, ("IPSecAddSA: keyLen: %d\n", keyLen));

    //
    // create SA block
    //
    status = IPSecCreateSA(&pSA);

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(SAAPI, ("IPSecAddSA: IPSecCreateSA failed: %lx\n", status));
        IPSecAbortAcquire(pAcquireContext);
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
        return status;
    }

    pSA->sa_Flags |= FLAGS_SA_OUTBOUND;

    //
    // Populate with the info in AddSA
    //
    status = IPSecPopulateSA(saInfo, keyLen, pSA);

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(SAAPI, ("IPSecAddSA: IPSecPopulateSA failed: %lx\n", status));
        // IPSecPopulateSA will not free the outbound SA so we have to do it.
        IPSecFreeSA(pSA);
        IPSecAbortAcquire(pAcquireContext);
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
        return status;
    }

    //
    // Stash the outermost spi
    //
    pSA->sa_SPI = pSA->sa_OtherSPIs[pSA->sa_NumOps-1];

    //
    // insert into proper tables
    //
    status = IPSecInsertOutboundSA(pSA, pAcquireContext, (BOOLEAN)((pSA->sa_Flags & FLAGS_SA_TUNNEL) != 0));

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(SAAPI, ("IPSecAddSA: IPSecInsertOutboundSA failed: %lx\n", status));
        IPSecFreeSA(pSA);
        IPSecAbortAcquire(pAcquireContext);
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
        return status;
    }

    pInboundSA = pAcquireContext->pSA;

    //
    // Associate the inbound and outbound SAs
    //
    pSA->sa_AssociatedSA = pInboundSA;
    pInboundSA->sa_AssociatedSA = pSA;
    pInboundSA->sa_State = STATE_SA_ASSOCIATED;

    //
    // Initialize IPSec overhead for the outbound SA.
    //
    IPSecCalcHeaderOverheadFromSA(pSA, &pSA->sa_IPSecOverhead);

    // Copy the NewMTU value over to the new SA.
    //
    pSA->sa_NewMTU = pInboundSA->sa_NewMTU;

    //
    // Adjust SA lifetime to the maximum/minimum allowed in driver
    //
    if (pSA->sa_Lifetime.KeyExpirationTime > IPSEC_MAX_EXPIRE_TIME) {
        pSA->sa_Lifetime.KeyExpirationTime = IPSEC_MAX_EXPIRE_TIME;
    }

    if (pSA->sa_Lifetime.KeyExpirationTime &&
        pSA->sa_Lifetime.KeyExpirationTime < IPSEC_MIN_EXPIRE_TIME) {
        pSA->sa_Lifetime.KeyExpirationTime = IPSEC_MIN_EXPIRE_TIME;
    }

    //
    // Setup lifetime characteristics
    //
    IPSecSetupSALifetime(pSA);

    //
    // Init the LastUsedTime
    //
    NdisGetCurrentSystemTime(&pSA->sa_LastUsedTime);

    //
    // outbound is ready to go!
    //
    pSA->sa_State = STATE_SA_ACTIVE;

    IPSEC_DEBUG(SA, ("IPSecAddSA: SA: %lx, S:%lx, D:%lx, O: %c\n",
                pSA,
                pSA->SA_SRC_ADDR,
                pSA->SA_DEST_ADDR,
                (pSA->sa_Operation[0] == Auth) ?
                    'A' : (pSA->sa_Operation[0] == Encrypt) ?
                        'E' : 'N'));

    IPSEC_INC_STATISTIC(dwNumActiveAssociations);
    IPSEC_INC_TUNNELS(pSA);
    IPSEC_INCREMENT(g_ipsec.NumOutboundSAs);
    IPSEC_INC_STATISTIC(dwNumKeyAdditions);

    if (pSA->sa_Operation[0] != None) {
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
    } else {
        //
        // The key manager doesnt call update for None;
        // call it ourselves.
        //
        IPSEC_UPDATE_SA   updSA;

        ASSERT(pInboundSA->sa_Flags & FLAGS_SA_TIMER_STARTED);
        IPSEC_DEBUG(SA, ("Calling update on InboundSA: %lx\n", pInboundSA));

        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);

        //
        // Reverse the addresses/ports here (by copying from the InboundSA)
        //
        updSA.SAInfo.Context = pAddSA->SAInfo.Context;
        updSA.SAInfo.NumSAs = pAddSA->SAInfo.NumSAs;
        updSA.SAInfo.Flags = pAddSA->SAInfo.Flags;
        updSA.SAInfo.TunnelAddr = pAddSA->SAInfo.TunnelAddr;
        updSA.SAInfo.Lifetime = pAddSA->SAInfo.Lifetime;
        updSA.SAInfo.InstantiatedFilter = pAddSA->SAInfo.InstantiatedFilter;
        updSA.SAInfo.SecAssoc[0] = pAddSA->SAInfo.SecAssoc[0];

        updSA.SAInfo.SecAssoc[0].SPI = pInboundSA->sa_SPI;
        updSA.SAInfo.InstantiatedFilter.SrcAddr = pInboundSA->SA_SRC_ADDR;
        updSA.SAInfo.InstantiatedFilter.DestAddr = pInboundSA->SA_DEST_ADDR;

        updSA.SAInfo.InstantiatedFilter.Protocol = pInboundSA->SA_PROTO;
        updSA.SAInfo.InstantiatedFilter.SrcPort = SA_SRC_PORT(pInboundSA);
        updSA.SAInfo.InstantiatedFilter.DestPort = SA_DEST_PORT(pInboundSA);

        status = IPSecUpdateSA(&updSA, TotalSize);
    }

    return status;
}


NTSTATUS
IPSecUpdateSA(
    IN  PIPSEC_UPDATE_SA    pUpdateSA,
    IN  ULONG               TotalSize
    )
/*++

Routine Description:

    Updates an inbound SA for which negotiation was kicked off via AcquireSA with
    the relevant keys/algorithms etc.

    By the time this routine is called, the SA should be ASSOCIATED with an outbound
    SA.

Arguments:

    pUpdateSA - Update SA context and info.

    TotalSize - the total size of the input buffer.

Return Value:


Notes:


--*/
{
    NTSTATUS        status = STATUS_SUCCESS;
    PSA_STRUCT      saInfo = &pUpdateSA->SAInfo;
    PSA_TABLE_ENTRY pSA;
    PSA_TABLE_ENTRY pOutboundSA;
    PSA_HASH        pHash;
    ULONG           keyLen = 0;
    KIRQL	        kIrql;
    KIRQL	        kIrql1;
    KIRQL	        kIrql2;
    PIPSEC_ACQUIRE_CONTEXT  pAcquireContext = (PIPSEC_ACQUIRE_CONTEXT)(saInfo->Context);

    IPSEC_DEBUG(SAAPI, ("IPSecUpdateSA\n"));

    //
    // Lock the larval list so this SA does not go away.
    //
    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql1);
    ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &kIrql);

    //
    // Sanity check the incoming context to see if it is actually
    // an SA block
    //
    if (!NT_SUCCESS(IPSecValidateHandle(pAcquireContext, STATE_SA_ASSOCIATED))) {
        IPSEC_DEBUG(SAAPI, ("IPSecUpdSA: invalid context: %lx\n", pAcquireContext));
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
        return  STATUS_INVALID_PARAMETER;
    }

    pSA = pAcquireContext->pSA;

    ASSERT((pSA->sa_Flags & FLAGS_SA_OUTBOUND) == 0);
    ASSERT(pSA->sa_State == STATE_SA_ASSOCIATED);

    //
    // figure out the key length and pass that in
    //
    keyLen = TotalSize - IPSEC_UPDATE_SA_NO_KEY_SIZE;

    IPSEC_DEBUG(SAAPI, ("IPSecUpdSA: keyLen: %d\n", keyLen));

    //
    // sanity check the info passed in against the initial SA
    //
    if (pSA->sa_Filter) {
        status = IPSecCheckInboundSA(saInfo, pSA);

        if (!NT_SUCCESS(status) ||
            !pSA->sa_AssociatedSA) {
            IPSEC_DEBUG(SAAPI, ("IPSecUpdSA: IPSecCheckInboundSA failed: %lx\n", status));
            IPSecAbortAcquire(pAcquireContext);
            RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
            ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
            return status;
        }
    }

    //
    // Populate the SA block
    //
    status = IPSecPopulateSA(saInfo, keyLen, pSA);

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(SAAPI, ("IPSecUpdSA: IPSecPopulateSA failed: %lx\n", status));
        // No need to free inbound SA since IPSecAbortAcquire will do it.
        IPSecAbortAcquire(pAcquireContext);
        RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
        ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
        return status;
    }

    //
    // Set the source Tunnel IP address in outbound SA
    //
    if (pOutboundSA = pSA->sa_AssociatedSA) {
        //
        // See if we have well-associated SAs
        //
        ASSERT(pSA == pSA->sa_AssociatedSA->sa_AssociatedSA);

        if (pSA->sa_Flags & FLAGS_SA_TUNNEL) {
            pOutboundSA->sa_SrcTunnelAddr = pSA->sa_TunnelAddr;
        }
        if (pOutboundSA->sa_Flags & FLAGS_SA_TUNNEL) {
            pSA->sa_SrcTunnelAddr = pOutboundSA->sa_TunnelAddr;
        }
    }

    //
    // Expire the original SA that kicked off this rekey
    //
    if (pSA->sa_Flags & FLAGS_SA_REKEY) {
        PSA_TABLE_ENTRY pOriSA;

        if (pOriSA = pSA->sa_RekeyOriginalSA) {
            KIRQL   kIrql;

            pSA->sa_RekeyOriginalSA = NULL;
            IPSEC_DEBUG(SA, ("Deleting original SA: pSA: %lx\n", pOriSA));

            if (pOriSA->sa_AssociatedSA) {
                IPSecExpireInboundSA(pOriSA->sa_AssociatedSA);
            }
            IPSEC_INC_STATISTIC(dwNumReKeys);
        }
    }

    //
    // inbound is ready to go!
    //
    pSA->sa_State = STATE_SA_ACTIVE;

    IPSEC_DEBUG(SA, ("IPSecUpdateSA: SA: %lx, S:%lx, D:%lx, O: %c\n",
                pSA,
                pSA->SA_SRC_ADDR,
                pSA->SA_DEST_ADDR,
                (pSA->sa_Operation[0] == Auth) ?
                    'A' : (pSA->sa_Operation[0] == Encrypt) ?
                        'E' : 'N'));

    //
    // Remove from larval list
    //
    IPSecRemoveEntryList(&pSA->sa_LarvalLinkage);
    IPSEC_DEC_STATISTIC(dwNumPendingKeyOps);

    RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);

    ASSERT(pSA->sa_Flags & FLAGS_SA_TIMER_STARTED);

    //
    // Bump the SA count for flush SA use; this is necessary because we flush
    // SA after releasing the lock because classification routine needs
    // it and the SA can be deleted right after we release the lock.
    //
    IPSecRefSA(pSA);

    //
    // Free the Acquire Context
    //
    ACQUIRE_LOCK(&pSA->sa_Lock, &kIrql);

    if (pSA->sa_AcquireCtx) {
        IPSecInvalidateHandle(pSA->sa_AcquireCtx);
        pSA->sa_AcquireCtx = NULL;
    }

    //
    // Adjust SA lifetime to the maximum/minimum allowed in driver
    //
    if (pSA->sa_Lifetime.KeyExpirationTime > IPSEC_MAX_EXPIRE_TIME) {
        pSA->sa_Lifetime.KeyExpirationTime = IPSEC_MAX_EXPIRE_TIME;
    }

    if (pSA->sa_Lifetime.KeyExpirationTime &&
        pSA->sa_Lifetime.KeyExpirationTime < IPSEC_MIN_EXPIRE_TIME) {
        pSA->sa_Lifetime.KeyExpirationTime = IPSEC_MIN_EXPIRE_TIME;
    }

   //
    // Setup lifetime characteristics
    //
    IPSecSetupSALifetime(pSA);

    //
    // Init the LastUsedTime
    //
    NdisGetCurrentSystemTime(&pSA->sa_LastUsedTime);


    if ((pSA->sa_Flags & FLAGS_SA_DISABLE_LIFETIME_CHECK)) {

        if (!IPSecStopTimer(&(pSA->sa_Timer))) {
            IPSEC_DEBUG(TIMER, ("Update: couldnt stop timer: %lx\n", pSA));
        }
        pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED;
    } else {

        //
        // Reschedules the timer on this new value.
        //
        if (pSA->sa_Lifetime.KeyExpirationTime) {
            if (IPSecStopTimer(&pSA->sa_Timer)) {
                IPSecStartTimer(&pSA->sa_Timer,
                                IPSecSAExpired,
                                pSA->sa_Lifetime.KeyExpirationTime,              // expire in key expiration secs
                                (PVOID)pSA);
            }
        } else {
            ASSERT(FALSE);
            if (!IPSecStopTimer(&(pSA->sa_Timer))) {
                IPSEC_DEBUG(TIMER, ("Update: couldnt stop timer: %lx\n", pSA));
            }
            pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED;
        }

    }
    RELEASE_LOCK(&pSA->sa_Lock, kIrql);

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);

    //
    // Flush all the queued packets
    //
    IPSecFlushQueuedPackets(pSA, STATUS_SUCCESS);
    IPSecDerefSA(pSA);

    return  status;
}


VOID
IPSecRefSA(
    IN  PSA_TABLE_ENTRY         pSA
    )
/*++

Routine Description:

    Reference the SA passed in

Arguments:

    pSA - SA to be refed

Return Value:

    The final status from the operation.

--*/
{
    if (IPSEC_INCREMENT(pSA->sa_Reference) == 1) {
        ASSERT(FALSE);
    }
}


VOID
IPSecDerefSA(
    IN  PSA_TABLE_ENTRY         pSA
    )
/*++

Routine Description:

    Dereference the SA passed in; if refcount drops to 0, free the block.

Arguments:

    pSA - SA to be derefed

Return Value:

    The final status from the operation.

--*/
{
    ULONG   val;

    if ((val = IPSEC_DECREMENT(pSA->sa_Reference)) == 0) {
        //
        // last reference - destroy SA
        //
        IPSEC_DEBUG(REF, ("Freeing SA: %lx\n", pSA));

#if DBG
        if ((pSA->sa_Flags & FLAGS_SA_HW_PLUMBED)) {
            DbgPrint("Freeing SA: %lx with offload on\n", pSA);
            DbgBreakPoint();
        }

        if (IPSEC_GET_VALUE(pSA->sa_NumSends) != 0) {
            DbgPrint("Freeing SA: %lx with numsends > 0\n", pSA);
            DbgBreakPoint();
        }

        if ((pSA->sa_Flags & FLAGS_SA_TIMER_STARTED)) {
            DbgPrint("Freeing SA: %lx with timer on\n", pSA);
            DbgBreakPoint();
        }

        if (pSA->sa_Signature != IPSEC_SA_SIGNATURE) {
            DbgPrint("Signature doesnt match for SA: %lx\n", pSA);
            DbgBreakPoint();
        }

        if (!IPSEC_DRIVER_IS_INACTIVE() &&
            (pSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST)) {
            DbgPrint("Freeing SA: %lx while still on filter list\n", pSA);
            DbgBreakPoint();
        }
#endif

        pSA->sa_Signature = IPSEC_SA_SIGNATURE + 1;

        IPSecFreeSA(pSA);
    }

    ASSERT((LONG)val >= 0);
}


VOID
IPSecStopSATimers()
/*++

Routine Description:

    Stop all timers active on Larval SA list and Filter list.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    PLIST_ENTRY     pFilterEntry;
    PLIST_ENTRY     pSAEntry;
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pSA;
    KIRQL           kIrql;
    LONG            Index;
    LONG            SAIndex;

    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    //
    // Go through all SA's and stop its timers
    //
    for (   Index = MIN_FILTER;
            Index <= MAX_FILTER;
            Index++) {

        for (   pFilterEntry = g_ipsec.FilterList[Index].Flink;
                pFilterEntry != &g_ipsec.FilterList[Index];
                pFilterEntry = pFilterEntry->Flink) {

            pFilter = CONTAINING_RECORD(pFilterEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex++) {

                for (   pSAEntry = pFilter->SAChain[SAIndex].Flink;
                        pSAEntry != &pFilter->SAChain[SAIndex];
                        pSAEntry = pSAEntry->Flink) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    IPSecStopSATimer(pSA);
                }
            }
        }
    }

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);
}


VOID
IPSecFlushLarvalSAList()
/*++

Routine Description:

    When the Acquire Irp is cancelled, this is called to flush all Larval SAs

    Called with SADB lock held (first); returns with it.
    Called with AcquireInfo.Lock held; returns with it.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    KIRQL           OldIrq;
    KIRQL           OldIrq1;
    KIRQL           kIrql;
    PSA_TABLE_ENTRY pLarvalSA;
    LIST_ENTRY      FreeList;

    InitializeListHead(&FreeList);

    while (TRUE) {
        if (!IsListEmpty(&g_ipsec.AcquireInfo.PendingAcquires)) {
            PLIST_ENTRY     pEntry;

            pEntry = RemoveHeadList(&g_ipsec.AcquireInfo.PendingAcquires);

            pLarvalSA = CONTAINING_RECORD(  pEntry,
                                            SA_TABLE_ENTRY,
                                            sa_PendingLinkage);
            ASSERT(pLarvalSA->sa_State == STATE_SA_LARVAL);
            ASSERT(pLarvalSA->sa_Flags & FLAGS_SA_PENDING);

            pLarvalSA->sa_Flags &= ~FLAGS_SA_PENDING;

            //
            // Insert into another list, which we walk without the lock
            //
            InsertTailList(&FreeList, &pLarvalSA->sa_PendingLinkage);

            //
            // also remove from Larval list
            //
            ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &OldIrq1);
            IPSecRemoveEntryList(&pLarvalSA->sa_LarvalLinkage);
            IPSEC_DEC_STATISTIC(dwNumPendingKeyOps);
            RELEASE_LOCK(&g_ipsec.LarvalListLock, OldIrq1);
        } else {
            break;
        }
    }

    //
    // get the remaining Larval SAs
    //
    ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &OldIrq);
    while (TRUE) {
        if (!IsListEmpty(&g_ipsec.LarvalSAList)) {
            PLIST_ENTRY     pEntry;

            pEntry = RemoveHeadList(&g_ipsec.LarvalSAList);

            pLarvalSA = CONTAINING_RECORD(  pEntry,
                                            SA_TABLE_ENTRY,
                                            sa_LarvalLinkage);

            //
            // Insert into another list, which we walk without the lock
            //
            InsertTailList(&FreeList, &pLarvalSA->sa_PendingLinkage);

        } else {
            break;
        }
    }
    RELEASE_LOCK(&g_ipsec.LarvalListLock, OldIrq);

    while (TRUE) {
        if (!IsListEmpty(&FreeList)) {
            PLIST_ENTRY     pEntry;

            pEntry = RemoveHeadList(&FreeList);

            pLarvalSA = CONTAINING_RECORD(  pEntry,
                                            SA_TABLE_ENTRY,
                                            sa_PendingLinkage);

            AcquireWriteLock(&g_ipsec.SPIListLock, &kIrql);
            IPSecRemoveSPIEntry(pLarvalSA);
            ReleaseWriteLock(&g_ipsec.SPIListLock, kIrql);

            //
            // Flush all the queued packets
            //
            IPSecFlushQueuedPackets(pLarvalSA, STATUS_TIMEOUT);

            //
            // also remove from the filter list
            //
            if (pLarvalSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
                pLarvalSA->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
                IPSecRemoveEntryList(&pLarvalSA->sa_FilterLinkage);
            }

            if (pLarvalSA->sa_RekeyOriginalSA) {
                ASSERT(pLarvalSA->sa_Flags & FLAGS_SA_REKEY);
                ASSERT(pLarvalSA->sa_RekeyOriginalSA->sa_RekeyLarvalSA == pLarvalSA);
                ASSERT(pLarvalSA->sa_RekeyOriginalSA->sa_Flags & FLAGS_SA_REKEY_ORI);

                pLarvalSA->sa_RekeyOriginalSA->sa_Flags &= ~FLAGS_SA_REKEY_ORI;
                pLarvalSA->sa_RekeyOriginalSA->sa_RekeyLarvalSA = NULL;
                pLarvalSA->sa_RekeyOriginalSA = NULL;
            }

            //
            // release acquire context and invalidate the associated cache entry
            //
            ACQUIRE_LOCK(&pLarvalSA->sa_Lock, &kIrql);
            if (pLarvalSA->sa_AcquireCtx) {
                IPSecInvalidateHandle(pLarvalSA->sa_AcquireCtx);
                pLarvalSA->sa_AcquireCtx = NULL;
            }
            RELEASE_LOCK(&pLarvalSA->sa_Lock, kIrql);

            IPSecInvalidateSACacheEntry(pLarvalSA);

            IPSecStopTimerDerefSA(pLarvalSA);
        } else {
            break;
        }
    }

    return;
}


NTSTATUS
IPSecDeleteSA(
    IN  PIPSEC_DELETE_SA    pDeleteSA
    )
/*++

Routine Description:

    Delete the SA matching the particulars passed in.  Both inbound and
    outbound SAs are deleted.  No timer set for inbound SA.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pSA, pInboundSA;
    PLIST_ENTRY     pEntry, pSAEntry;
    KIRQL           kIrql;
    LONG            Index;
    LONG            SAIndex;

    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    //
    // Walk through the outbound SAs and delete matched ones.
    //
    for (   Index = OUTBOUND_TRANSPORT_FILTER;
            Index <= OUTBOUND_TUNNEL_FILTER;
            Index += TRANSPORT_TUNNEL_INCREMENT) {

        for (   pEntry = g_ipsec.FilterList[Index].Flink;
                pEntry != &g_ipsec.FilterList[Index];
                pEntry = pEntry->Flink) {

            pFilter = CONTAINING_RECORD(pEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex++) {

                pSAEntry = pFilter->SAChain[SAIndex].Flink;

                while (pSAEntry != &pFilter->SAChain[SAIndex]) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    pSAEntry = pSAEntry->Flink;

                    if (IPSecMatchSATemplate(pSA, &pDeleteSA->SATemplate)) {
                        ASSERT(pSA->sa_State == STATE_SA_ACTIVE);
                        ASSERT(pSA->sa_Flags & FLAGS_SA_OUTBOUND);
                        ASSERT(pSA->sa_AssociatedSA);

                        pInboundSA = pSA->sa_AssociatedSA;
                        if (pInboundSA) {
                            IPSecDeleteInboundSA(pInboundSA);
                        }
                    }
                }
            }
        }
    }

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);

    return  STATUS_SUCCESS;
}


NTSTATUS
IPSecExpireSA(
    IN  PIPSEC_EXPIRE_SA    pExpireSA
    )
/*++

Routine Description:

    Expires the SA matching the particulars passed in.
    Applied to Inbound SAs - we place the SA in the timer queue
    for the next time the timer hits. Also, we delete the
    corresponding outbound SA so no further packets match that
    SA.

Arguments:


Return Value:

    The final status from the operation.

--*/
{
    PSA_TABLE_ENTRY pInboundSA;
    KIRQL           kIrql;
    NTSTATUS        status;

    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    pInboundSA = IPSecLookupSABySPI(pExpireSA->DelInfo.SPI,
                                    pExpireSA->DelInfo.DestAddr);

    if (pInboundSA) {
        ASSERT((pInboundSA->sa_Flags & FLAGS_SA_OUTBOUND) == 0);

        if (pInboundSA->sa_State == STATE_SA_ACTIVE) {
            IPSEC_DEBUG(ACQUIRE, ("Expiring SA: %lx\n", pInboundSA));

            if (pInboundSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
                pInboundSA->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
                IPSecRemoveEntryList(&pInboundSA->sa_FilterLinkage);
            }

            pInboundSA->sa_Flags |= FLAGS_SA_DELETE_BY_IOCTL;

            IPSecExpireInboundSA(pInboundSA);
        }

        status = STATUS_SUCCESS;
    } else {
        IPSEC_DEBUG(ACQUIRE, ("Expire for a non-existent SA: %lx\n", pExpireSA));

        status = STATUS_NO_MATCH;
    }

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);

    return  status;
}


VOID
IPSecSAExpired(
    IN	PIPSEC_TIMER	pTimer,
    IN	PVOID		Context
    )
/*++

Routine Description:

     Called when an SA has expired or when a Larval SA has timed out.

Arguments:

    pTimer - the timer struct

    Context - SA ptr

Return Value:

    STATUS_PENDING if the buffer is to be held on to, the normal case.

Notes:


--*/
{
    PSA_TABLE_ENTRY pSA = (PSA_TABLE_ENTRY)Context;
    PSA_TABLE_ENTRY pOutboundSA;
    KIRQL       	kIrql;
    KIRQL       	kIrql1;
    KIRQL       	kIrql2;
    KIRQL           OldIrq;

    IPSEC_DEBUG(TIMER, ("IPSecSAExpired: pSA: %lx state: %lx\n", pSA, pSA->sa_State));

    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql1);
    ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &kIrql);

    switch (pSA->sa_State) {
    case   STATE_SA_CREATED:
        ASSERT(FALSE);
        break;

    case   STATE_SA_LARVAL:
    case   STATE_SA_ASSOCIATED:
        //
        // Lock the larval list so this SA does not go away.
        //
        ASSERT((pSA->sa_Flags & FLAGS_SA_OUTBOUND) == 0);

        //
        // Remove from larval list
        //
        IPSecRemoveEntryList(&pSA->sa_LarvalLinkage);
        IPSEC_DEC_STATISTIC(dwNumPendingKeyOps);

        //
        // Also remove from Pending list if queued there.
        //
        ACQUIRE_LOCK(&g_ipsec.AcquireInfo.Lock, &kIrql1);
        if (pSA->sa_Flags & FLAGS_SA_PENDING) {
            ASSERT(pSA->sa_State == STATE_SA_LARVAL);
            IPSEC_DEBUG(ACQUIRE, ("IPSecSAExpired: Removed from pending too: %lx\n", pSA));
            IPSecRemoveEntryList(&pSA->sa_PendingLinkage);
            pSA->sa_Flags &= ~FLAGS_SA_PENDING;
        }
        RELEASE_LOCK(&g_ipsec.AcquireInfo.Lock, kIrql1);

        //
        // Flush all the queued packets
        //
        IPSecFlushQueuedPackets(pSA, STATUS_TIMEOUT);

        //
        // remove from inbound sa list
        //
        AcquireWriteLock(&g_ipsec.SPIListLock, &kIrql1);
        IPSecRemoveSPIEntry(pSA);
        ReleaseWriteLock(&g_ipsec.SPIListLock, kIrql1);

        //
        // also remove from the filter list
        //
        if (pSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
            pSA->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
            IPSecRemoveEntryList(&pSA->sa_FilterLinkage);
        }

        //
        // invalidate the associated cache entry
        //
        ACQUIRE_LOCK(&pSA->sa_Lock, &kIrql2);
        if (pSA->sa_AcquireCtx) {
            IPSecInvalidateHandle(pSA->sa_AcquireCtx);
            pSA->sa_AcquireCtx = NULL;
        }
        RELEASE_LOCK(&pSA->sa_Lock, kIrql2);

        IPSecInvalidateSACacheEntry(pSA);

        pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED;

        if (pSA->sa_RekeyOriginalSA) {
            ASSERT(pSA->sa_Flags & FLAGS_SA_REKEY);
            ASSERT(pSA->sa_RekeyOriginalSA->sa_RekeyLarvalSA == pSA);
            ASSERT(pSA->sa_RekeyOriginalSA->sa_Flags & FLAGS_SA_REKEY_ORI);

            pSA->sa_RekeyOriginalSA->sa_Flags &= ~FLAGS_SA_REKEY_ORI;
            pSA->sa_RekeyOriginalSA->sa_RekeyLarvalSA = NULL;
            pSA->sa_RekeyOriginalSA = NULL;
        }

        if (pOutboundSA = pSA->sa_AssociatedSA) {

            IPSEC_DEC_STATISTIC(dwNumActiveAssociations);
            IPSEC_DEC_TUNNELS(pOutboundSA);
            IPSEC_DECREMENT(g_ipsec.NumOutboundSAs);

            IPSecCleanupOutboundSA(pSA, pOutboundSA, FALSE);
        }

        IPSEC_DEBUG(REF, ("Timer in Deref\n"));
        IPSecDerefSA(pSA);

        break;

    case   STATE_SA_ZOMBIE:
        ASSERT(FALSE);
        break;

    case   STATE_SA_ACTIVE:
        //
        // Inbound SA being expired; outbound was deleted immediately
        //
        ASSERT((pSA->sa_Flags & FLAGS_SA_OUTBOUND) == 0);

        ACQUIRE_LOCK(&g_ipsec.AcquireInfo.Lock, &OldIrq);
        IPSecNotifySAExpiration(pSA, NULL, OldIrq, FALSE);

        //
        // remove from inbound sa list
        //
        AcquireWriteLock(&g_ipsec.SPIListLock, &kIrql1);
        IPSecRemoveSPIEntry(pSA);
        ReleaseWriteLock(&g_ipsec.SPIListLock, kIrql1);

        //
        // also remove from the filter list
        //
        if (pSA->sa_Flags & FLAGS_SA_ON_FILTER_LIST) {
            pSA->sa_Flags &= ~FLAGS_SA_ON_FILTER_LIST;
            IPSecRemoveEntryList(&pSA->sa_FilterLinkage);
        }

        //
        // invalidate the associated cache entry
        //
        IPSecInvalidateSACacheEntry(pSA);

        pSA->sa_Flags &= ~FLAGS_SA_TIMER_STARTED;

        if (pOutboundSA = pSA->sa_AssociatedSA) {

            IPSEC_DEC_STATISTIC(dwNumActiveAssociations);
            IPSEC_DEC_TUNNELS(pOutboundSA);
            IPSEC_DECREMENT(g_ipsec.NumOutboundSAs);

            IPSecCleanupOutboundSA(pSA, pOutboundSA, FALSE);
        }

        if (pSA->sa_Flags & FLAGS_SA_HW_PLUMBED) {
            IPSecDelHWSAAtDpc(pSA);
        }

        ASSERT(pSA->sa_AssociatedSA == NULL);
        IPSEC_DEBUG(REF, ("Timer#2 in Deref\n"));
        IPSecDerefSA(pSA);

        break;

    default:
        ASSERT(FALSE);
    }

    RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);
    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql1);
}


VOID
IPSecFillSAInfo(
    IN  PSA_TABLE_ENTRY pSA,
    OUT PIPSEC_SA_INFO  pBuf
    )
/*++

Routine Description:

    Fill out the SA_INFO structure.

Arguments:

    pSA     - SA to be filled in
    pBuf    - where to fill in

Returns:

    None.

--*/
{
    LONG            Index;
    PSA_TABLE_ENTRY pAssociatedSA = pSA->sa_AssociatedSA;

    RtlZeroMemory(pBuf, sizeof(IPSEC_SA_INFO));

    pBuf->PolicyId = pSA->sa_Filter->PolicyId;
    pBuf->FilterId = pSA->sa_Filter->FilterId;
    pBuf->Lifetime = pSA->sa_Lifetime;
    pBuf->InboundTunnelAddr = pSA->sa_SrcTunnelAddr;
    pBuf->NumOps = pSA->sa_NumOps;

    pBuf->dwQMPFSGroup = pSA->sa_QMPFSGroup;
    RtlCopyMemory(  &pBuf->CookiePair,
                    &pSA->sa_CookiePair,
                    sizeof(IKE_COOKIE_PAIR));

    for (Index = 0; Index < pSA->sa_NumOps; Index++) {
        pBuf->Operation[Index] = pSA->sa_Operation[Index];

        pBuf->EXT_INT_ALGO_EX(Index) = pSA->INT_ALGO(Index);
        pBuf->EXT_INT_KEYLEN_EX(Index) = pSA->INT_KEYLEN(Index);
        pBuf->EXT_INT_ROUNDS_EX(Index) = pSA->INT_ROUNDS(Index);

        pBuf->EXT_CONF_ALGO_EX(Index) = pSA->CONF_ALGO(Index);
        pBuf->EXT_CONF_KEYLEN_EX(Index) = pSA->CONF_KEYLEN(Index);
        pBuf->EXT_CONF_ROUNDS_EX(Index) = pSA->CONF_ROUNDS(Index);

        if (pAssociatedSA) {
            pBuf->InboundSPI[Index] = pAssociatedSA->sa_OtherSPIs[Index];
        }
        pBuf->OutboundSPI[Index] = pSA->sa_OtherSPIs[Index];
    }

    pBuf->AssociatedFilter.SrcAddr = pSA->SA_SRC_ADDR & pSA->SA_SRC_MASK;
    pBuf->AssociatedFilter.SrcMask = pSA->SA_SRC_MASK;
    pBuf->AssociatedFilter.DestAddr = pSA->SA_DEST_ADDR & pSA->SA_DEST_MASK;
    pBuf->AssociatedFilter.DestMask = pSA->SA_DEST_MASK;
    pBuf->AssociatedFilter.Protocol = pSA->SA_PROTO;
    pBuf->AssociatedFilter.SrcPort = SA_SRC_PORT(pSA);
    pBuf->AssociatedFilter.DestPort = SA_DEST_PORT(pSA);
    pBuf->AssociatedFilter.TunnelAddr = pSA->sa_TunnelAddr;
    pBuf->AssociatedFilter.TunnelFilter = (pSA->sa_Flags & FLAGS_SA_TUNNEL) != 0;

    if (pSA->sa_Flags & FLAGS_SA_OUTBOUND) {
        pBuf->AssociatedFilter.Flags = FILTER_FLAGS_OUTBOUND;
    } else {
        pBuf->AssociatedFilter.Flags = FILTER_FLAGS_INBOUND;
    }

    if (pSA->sa_Flags & FLAGS_SA_INITIATOR) {
        pBuf->EnumFlags |= SA_ENUM_FLAGS_INITIATOR;
    }
    if (pSA->sa_Flags & FLAGS_SA_MTU_BUMPED) {
        pBuf->EnumFlags |= SA_ENUM_FLAGS_MTU_BUMPED;
    }
    if (pSA->sa_Flags & FLAGS_SA_HW_PLUMBED) {
        pBuf->EnumFlags |= SA_ENUM_FLAGS_OFFLOADED;
    }
    if (pSA->sa_Flags & FLAGS_SA_HW_PLUMB_FAILED) {
        pBuf->EnumFlags |= SA_ENUM_FLAGS_OFFLOAD_FAILED;
    }
    if (pSA->sa_Flags & FLAGS_SA_OFFLOADABLE) {
        pBuf->EnumFlags |= SA_ENUM_FLAGS_OFFLOADABLE;
    }
    if (pSA->sa_Flags & FLAGS_SA_REKEY_ORI) {
        pBuf->EnumFlags |= SA_ENUM_FLAGS_IN_REKEY;
    }

    pBuf->Stats.ConfidentialBytesSent = pSA->sa_Stats.ConfidentialBytesSent;
    pBuf->Stats.AuthenticatedBytesSent = pSA->sa_Stats.AuthenticatedBytesSent;
    pBuf->Stats.TotalBytesSent = pSA->sa_Stats.TotalBytesSent;
    pBuf->Stats.OffloadedBytesSent = pSA->sa_Stats.OffloadedBytesSent;

    if (pAssociatedSA) {
        pBuf->Stats.ConfidentialBytesReceived =
            pAssociatedSA->sa_Stats.ConfidentialBytesReceived;
        pBuf->Stats.AuthenticatedBytesReceived =
            pAssociatedSA->sa_Stats.AuthenticatedBytesReceived;
        pBuf->Stats.TotalBytesReceived =
            pAssociatedSA->sa_Stats.TotalBytesReceived;
        pBuf->Stats.OffloadedBytesReceived =
            pAssociatedSA->sa_Stats.OffloadedBytesReceived;
    }
}


NTSTATUS
IPSecEnumSAs(
    IN  PIRP    pIrp,
    OUT PULONG  pBytesCopied
    )
/*++

Routine Description:

    Fills in the request to enumerate SAs.

Arguments:

    pIrp            - The actual Irp
    pBytesCopied    - the number of bytes copied.

Returns:

    Status of the operation.

--*/
{
    PNDIS_BUFFER    NdisBuffer = NULL;
    PIPSEC_ENUM_SAS pEnum = NULL;
    ULONG           BufferLength = 0;
    KIRQL           kIrql;
    PLIST_ENTRY     pEntry;
    PLIST_ENTRY     pSAEntry;
    IPSEC_SA_INFO   infoBuff = {0};
    NTSTATUS        status = STATUS_SUCCESS;
    ULONG           BytesCopied = 0;
    ULONG           Offset = 0;
    PFILTER         pFilter;
    PSA_TABLE_ENTRY pSA;
    LONG            Index;
    LONG            FilterIndex;
    LONG            SAIndex;

    //
    // Get at the IO buffer - its in the MDL
    //
    NdisBuffer = REQUEST_NDIS_BUFFER(pIrp);
    if (NdisBuffer == NULL) {
        return STATUS_INVALID_PARAMETER;
    }

    NdisQueryBufferSafe(NdisBuffer,
                        (PVOID *)&pEnum,
                        &BufferLength,
                        NormalPagePriority);

    //
    // Make sure NdisQueryBufferSafe succeeds.
    //
    if (!pEnum) {
        IPSEC_DEBUG (IOCTL, ("EnumSAs failed, no resources\n"));
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    //
    // Make sure we have enough room for just the header not
    // including the data.
    //
    if (BufferLength < (UINT)(FIELD_OFFSET(IPSEC_ENUM_SAS, pInfo[0]))) {
        IPSEC_DEBUG (IOCTL, ("EnumSAs failed, buffer too small\n"));
        return STATUS_BUFFER_TOO_SMALL;
    }

    //
    // Make sure we are naturally aligned.
    //
    if (((ULONG_PTR)(pEnum)) & (TYPE_ALIGNMENT(IPSEC_ENUM_SAS) - 1)) {
        IPSEC_DEBUG (IOCTL, ("EnumSAs failed, alignment\n"));
        return STATUS_DATATYPE_MISALIGNMENT_ERROR;
    }

    pEnum->NumEntries = 0;
    pEnum->NumEntriesPresent = 0;

    //
    // Now copy over the SA data into the user buffer and fit as many as possible.
    //
    BufferLength -= FIELD_OFFSET(IPSEC_ENUM_SAS, pInfo[0]);
    Offset = FIELD_OFFSET(IPSEC_ENUM_SAS, pInfo[0]);

    Index = pEnum->Index;   // where to start?

    AcquireReadLock(&g_ipsec.SADBLock, &kIrql);

    for (   FilterIndex = MIN_FILTER;
            FilterIndex <= MAX_FILTER;
            FilterIndex++) {

        for (   pEntry = g_ipsec.FilterList[FilterIndex].Flink;
                pEntry != &g_ipsec.FilterList[FilterIndex];
                pEntry = pEntry->Flink) {

            pFilter = CONTAINING_RECORD(pEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex ++) {

                for (   pSAEntry = pFilter->SAChain[SAIndex].Flink;
                        pSAEntry != &pFilter->SAChain[SAIndex];
                        pSAEntry = pSAEntry->Flink) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    //
                    // Only interested in outbound or multicast SAs.
                    //
                    if (!(pSA->sa_Flags & FLAGS_SA_OUTBOUND)) {
                        continue;
                    }

                    //
                    // Dump only SAs that match the template.
                    //
                    if (IPSecMatchSATemplate(pSA, &pEnum->SATemplate)) {
                        if (Index > 0) {
                            Index--;    // Skip number of Index SAs.
                            continue;
                        }

                        pEnum->NumEntriesPresent++;

                        if ((INT)(BufferLength - BytesCopied) >= (INT)sizeof(IPSEC_SA_INFO)) {
                            IPSecFillSAInfo(pSA, &infoBuff);
                            BytesCopied += sizeof(IPSEC_SA_INFO);
                            NdisBuffer = CopyToNdis(NdisBuffer, (UCHAR *)&infoBuff, sizeof(IPSEC_SA_INFO), &Offset);
                            if (!NdisBuffer) {
                                ReleaseReadLock(&g_ipsec.SADBLock, kIrql);
                                return STATUS_INSUFFICIENT_RESOURCES;
                            }
                        }
                    }
                }
            }
        }
    }

    ReleaseReadLock(&g_ipsec.SADBLock, kIrql);

    pEnum->NumEntries = BytesCopied / sizeof(IPSEC_SA_INFO);

    *pBytesCopied = BytesCopied + FIELD_OFFSET(IPSEC_ENUM_SAS, pInfo[0]);

    if (pEnum->NumEntries < pEnum->NumEntriesPresent) {
        status = STATUS_BUFFER_OVERFLOW;
    }

    return status;
}


VOID
IPSecReaper(
    IN	PIPSEC_TIMER	pTimer,
    IN	PVOID		Context
    )
/*++

Routine Description:

    Called every 5 mins; reaps the (active) SA list

Arguments:

    pTimer - the timer struct

    Context - NULL

Return Value:

    STATUS_PENDING if the buffer is to be held on to, the normal case.

Notes:


--*/
{
    KIRQL	kIrql;

    IPSEC_DEBUG(TIMER, ("Entering IPSecReaper\n"));

    AcquireWriteLock(&g_ipsec.SADBLock, &kIrql);

    //
    // walk the outbound SAs and delete/expire them if they have been
    // idle for sometime (lets say 5 mins for now).
    //
    IPSecReapIdleSAs();

    ReleaseWriteLock(&g_ipsec.SADBLock, kIrql);

    IPSEC_DEBUG(TIMER, ("Exiting IPSecReaper\n"));
    if (!IPSEC_DRIVER_IS_INACTIVE()) {
        IPSecStartTimer(&g_ipsec.ReaperTimer,
                        IPSecReaper,
                        IPSEC_REAPER_TIME,
                        (PVOID)NULL);
    }
}


VOID
IPSecReapIdleSAs()
/*++

Routine Description:

    Called to reap the idle SA list

Arguments:


Return Value:


--*/
{
    PSA_TABLE_ENTRY pSA;
    PFILTER         pFilter;
    PLIST_ENTRY     pEntry;
    PLIST_ENTRY     pSAEntry;
    BOOLEAN         fExpired;
    LONG            Index;
    LONG            SAIndex;

    IPSEC_DEBUG(TIMER, ("Entering IPSecReapIdleSAs\n"));

    //
    // Walk the inbound SAs and delete/expire them if they have been
    // idle for sometime (lets say 5 mins for now).
    //
    for (   Index = INBOUND_TRANSPORT_FILTER;
            Index <= INBOUND_TUNNEL_FILTER;
            Index += TRANSPORT_TUNNEL_INCREMENT) {

        for (   pEntry = g_ipsec.FilterList[Index].Flink;
                pEntry != &g_ipsec.FilterList[Index];
                pEntry = pEntry->Flink) {

            pFilter = CONTAINING_RECORD(pEntry,
                                        FILTER,
                                        MaskedLinkage);

            for (   SAIndex = 0;
                    SAIndex < pFilter->SAChainSize;
                    SAIndex++) {

                pSAEntry = pFilter->SAChain[SAIndex].Flink;

                while (pSAEntry != &pFilter->SAChain[SAIndex]) {

                    pSA = CONTAINING_RECORD(pSAEntry,
                                            SA_TABLE_ENTRY,
                                            sa_FilterLinkage);

                    ASSERT(!(pSA->sa_Flags & FLAGS_SA_OUTBOUND));

                    pSAEntry = pSAEntry->Flink;

                    if (!(pSA->sa_Flags & FLAGS_SA_IDLED_OUT) &&
                        (pSA->sa_State == STATE_SA_ACTIVE) &&
                        !(pSA->sa_Flags & FLAGS_SA_DISABLE_IDLE_OUT)) {

                        IPSEC_SA_EXPIRED(pSA, fExpired);
                        if (fExpired) {
                            pSA->sa_Flags |= FLAGS_SA_IDLED_OUT;
                            IPSecExpireInboundSA(pSA);
                        }
                    }
                }
            }
        }
    }

    IPSEC_DEBUG(TIMER, ("Exiting IPSecReapIdleSAs\n"));
}


VOID
IPSecFlushEventLog(
    IN	PIPSEC_TIMER	pTimer,
    IN	PVOID		Context
    )
/*++

Routine Description:

    Called every LogInterval seconds; flush all events currently logged.

Arguments:

    pTimer - the timer struct

    Context - NULL

Return Value:


Notes:


--*/
{
    KIRQL   kIrql;

    IPSEC_DEBUG(TIMER, ("Entering IPSecFlushEventLog\n"));

    ACQUIRE_LOCK(&g_ipsec.EventLogLock, &kIrql);

    if (g_ipsec.IPSecLogMemoryLoc > g_ipsec.IPSecLogMemory) {
        //
        // Flush the logs.
        //
        IPSecQueueLogEvent();
    }

    RELEASE_LOCK(&g_ipsec.EventLogLock, kIrql);

    if (!IPSEC_DRIVER_IS_INACTIVE()) {
        IPSecStartTimer(&g_ipsec.EventLogTimer,
                        IPSecFlushEventLog,
                        g_ipsec.LogInterval,
                        (PVOID)NULL);
    }
}


NTSTATUS
IPSecQuerySpi(
    IN OUT PIPSEC_QUERY_SPI pQuerySpi
    )
/*++

Routine Description:

    Queries IPSEC for spis corresponding to given filter

Arguments:


Return Value:


Notes:


--*/
{
    NTSTATUS    status;

    ULARGE_INTEGER  uliSrcDstAddr;
    ULARGE_INTEGER  uliProtoSrcDstPort;
    PFILTER         pFilter = NULL;
    PSA_TABLE_ENTRY pSA = NULL;
    PSA_TABLE_ENTRY pNextSA = NULL;
    PSA_TABLE_ENTRY pTunnelSA = NULL;
    KIRQL           kIrql;

    pQuerySpi->Spi          = 0;
    pQuerySpi->OtherSpi     = 0;
    pQuerySpi->Operation    = 0;

    IPSEC_DEBUG(ACQUIRE, ("IPSecQuerySPI: Src %08x.%04x Dst %08x.%04x Protocol %d",
                          pQuerySpi->Filter.SrcAddr,
                          pQuerySpi->Filter.SrcPort,
                          pQuerySpi->Filter.DestAddr,
                          pQuerySpi->Filter.DestPort,
                          pQuerySpi->Filter.Protocol));

    IPSEC_BUILD_SRC_DEST_ADDR(  uliSrcDstAddr,
                                pQuerySpi->Filter.SrcAddr,
                                pQuerySpi->Filter.DestAddr);

    IPSEC_BUILD_PROTO_PORT_LI(  uliProtoSrcDstPort,
                                pQuerySpi->Filter.Protocol,
                                pQuerySpi->Filter.SrcPort,
                                pQuerySpi->Filter.DestPort);


    AcquireReadLock(&g_ipsec.SADBLock, &kIrql);

    //
    // search for SA
    //
    status = IPSecLookupSAByAddr(   uliSrcDstAddr,
                                    uliProtoSrcDstPort,
                                    &pFilter,
                                    &pSA,
                                    &pNextSA,
                                    &pTunnelSA,
                                    FALSE,
                                    FALSE,
                                    FALSE);

    if (!NT_SUCCESS(status)) {
        IPSEC_DEBUG(ACQUIRE, ("IPSecQuerySPI: IPSecLookupSAByAddr failed: %lx\n", status));
        ReleaseReadLock(&g_ipsec.SADBLock, kIrql);
        return status;
    }

    if (status == STATUS_SUCCESS) {
        ASSERT(pSA);
    } else {
        ReleaseReadLock(&g_ipsec.SADBLock, kIrql);
        return STATUS_SUCCESS;
    }

    pQuerySpi->Spi = pSA->sa_SPI;

    if (pSA->sa_AssociatedSA) {
        pQuerySpi->OtherSpi = pSA->sa_AssociatedSA->sa_SPI;
    }

    pQuerySpi->Operation = pSA->sa_Operation[pSA->sa_NumOps-1];

    ReleaseReadLock(&g_ipsec.SADBLock, kIrql);

    return STATUS_SUCCESS;
}


NTSTATUS
IPSecSetOperationMode(
    IN PIPSEC_SET_OPERATION_MODE    pSetOperationMode
    )
/*++

Routine Description:

    Set the driver operation mode.

Arguments:



Return Value:



Notes:


--*/
{
    g_ipsec.OperationMode = pSetOperationMode->OperationMode;
   
    return  STATUS_SUCCESS;
}


NTSTATUS
IPSecInitializeTcpip(
    IN PIPSEC_SET_TCPIP_STATUS  pSetTcpipStatus
    )
/*++

Routine Description:

    Initialize TCP/IP.

Arguments:



Return Value:



Notes:


--*/
{
    IPInfo  Info;

    if (IPSEC_DRIVER_INIT_TCPIP()) {
        return  STATUS_SUCCESS;
    }

    //
    // Store all TCP/IP function pointers for future use.  There is no check
    // for NULL pointer here because the function pointer can also be stale
    // address.  We trust TCP/IP to pass in the values corretly.
    //
    TCPIP_FREE_BUFF = pSetTcpipStatus->TcpipFreeBuff;
    TCPIP_ALLOC_BUFF = pSetTcpipStatus->TcpipAllocBuff;
    TCPIP_GET_INFO = pSetTcpipStatus->TcpipGetInfo;
    TCPIP_NDIS_REQUEST = pSetTcpipStatus->TcpipNdisRequest;
    TCPIP_SET_IPSEC_STATUS = pSetTcpipStatus->TcpipSetIPSecStatus;
    TCPIP_SET_IPSEC = pSetTcpipStatus->TcpipSetIPSecPtr;
    TCPIP_UNSET_IPSEC = pSetTcpipStatus->TcpipUnSetIPSecPtr;
    TCPIP_UNSET_IPSEC_SEND = pSetTcpipStatus->TcpipUnSetIPSecSendPtr;
    TCPIP_TCP_XSUM = pSetTcpipStatus->TcpipTCPXsum;

    //
    // Initialize IPInfo for reinjecting packets to TCP/IP.
    //
    if (TCPIP_GET_INFO(&Info, sizeof(IPInfo)) != IP_SUCCESS) {
        ASSERT(FALSE);
        return  STATUS_BUFFER_TOO_SMALL;
    }

    Info.ipi_initopts(&g_ipsec.OptInfo);

    //
    // The followings come from IPInfo.
    //
    TCPIP_REGISTER_PROTOCOL = Info.ipi_protreg;
    TCPIP_DEREGISTER_PROTOCOL = Info.ipi_protdereg;
    TCPIP_IP_TRANSMIT = Info.ipi_xmit;
    TCPIP_GET_ADDRTYPE = Info.ipi_getaddrtype;
    TCPIP_GEN_IPID = Info.ipi_getipid;

    //
    // Don't register IPSecStatus function for AH and ESP protocol here.
    // Registration occurs with filter addition.
    //

    //
    // Everything is ready to go, bind to IP so we will intercept traffic.
    //
    IPSecBindToIP();

    IPSEC_DRIVER_INIT_TCPIP() = TRUE;

    return STATUS_SUCCESS;
}


NTSTATUS
IPSecDeinitializeTcpip(
    VOID
    )
/*++

Routine Description:

    Deinitialize TCP/IP.

Arguments:



Return Value:



Notes:


--*/
{
    if (!IPSEC_DRIVER_INIT_TCPIP()) {
        return  STATUS_SUCCESS;
    }

    IPSEC_DRIVER_INIT_TCPIP() = FALSE;

    //
    // Unbind IPSecHandlerPtr from TCP/IP and wait for all transmits, pending
    // sends, worker threads and iotcls to complete.
    //
    IPSecUnbindSendFromIP();

    //
    // Wait for all threads (transmits) to finish.
    //
    while (IPSEC_GET_VALUE(g_ipsec.NumThreads) != 0) {
        IPSEC_DELAY_EXECUTION();
    }

    //
    // Wait for all pending IOCTLs to finish.  Note this current IOCTL also
    // takes one count.
    //
    while (IPSEC_GET_VALUE(g_ipsec.NumIoctls) != 1) {
        IPSEC_DELAY_EXECUTION();
    }

    //
    // Wait for all worker threads (logs or plumbs) to finish.
    //
    while (IPSEC_GET_VALUE(g_ipsec.NumWorkers) != 0) {
        IPSEC_DELAY_EXECUTION();
    }

    //
    // Wait for all send completes to go through.
    //
    while (IPSEC_GET_VALUE(g_ipsec.NumSends) != 0) {
        IPSEC_DELAY_EXECUTION();
    }

    //
    // Reset IPSecStatus functions in TCP/IP to NULL.
    //
    if (IPSEC_GET_VALUE(gdwInitEsp)) {
        TCPIP_DEREGISTER_PROTOCOL(PROTOCOL_ESP);
        IPSEC_SET_VALUE(gdwInitEsp, 0);
    }
    if (IPSEC_GET_VALUE(gdwInitAh)) {
        TCPIP_DEREGISTER_PROTOCOL(PROTOCOL_AH);
        IPSEC_SET_VALUE(gdwInitAh, 0);
    }

    //
    // Unbind the rest of IPSec routines from TCP/IP.
    //
    IPSecUnbindFromIP();

    return  STATUS_SUCCESS;
}


NTSTATUS
IPSecSetTcpipStatus(
    IN PIPSEC_SET_TCPIP_STATUS  pSetTcpipStatus
    )
/*++

Routine Description:

    Set the TCP/IP driver status indicating whether can register with it.

Arguments:



Return Value:



Notes:


--*/
{
    PAGED_CODE();

    if (pSetTcpipStatus->TcpipStatus) {
        return  IPSecInitializeTcpip(pSetTcpipStatus);
    } else {
        return  IPSecDeinitializeTcpip();
    }
}


NTSTATUS
IPSecResetCacheTable(
    VOID
    )
/*++

Routine Description:

    Invalidate all cache entries and its associated SA or Filter.

Arguments:


Return Value:


Notes:


--*/
{
    PFILTER_CACHE   pCache;
    ULONG           i;

    for (i = 0; i < g_ipsec.CacheSize; i ++) {
        pCache = g_ipsec.ppCache[i];
        if (pCache && IS_VALID_CACHE_ENTRY(pCache)) {
            if (pCache->FilterEntry) {
                pCache->pFilter->FilterCache = NULL;
            } else {
                pCache->pSAEntry->sa_FilterCache = NULL;
                if (pCache->pNextSAEntry) {
                    pCache->pNextSAEntry->sa_FilterCache = NULL;
                }
            }
            INVALIDATE_CACHE_ENTRY(pCache);
        }
    }

    return  STATUS_SUCCESS;
}


NTSTATUS
IPSecPurgeFilterSAs(
    IN PFILTER             pFilter
    )
/*++

Routine Description

    Delete all SAs that are related to this filter.

Locks

    Called with SADB held.

Arguments

    pFilter - filter of interest

Return Value

    STATUS_SUCCESS

--*/
{
    PLIST_ENTRY     pEntry;
    PSA_TABLE_ENTRY pSA;
    KIRQL           kIrql;
    LONG            Index;

    //
    // Expire each inbound SA and delete outbound SA
    //
    for (Index = 0; Index < pFilter->SAChainSize; Index ++) {
        pEntry = pFilter->SAChain[Index].Flink;

        while (pEntry != &pFilter->SAChain[Index]) {

            pSA = CONTAINING_RECORD(pEntry,
                                    SA_TABLE_ENTRY,
                                    sa_FilterLinkage);

            pEntry = pEntry->Flink;

            if (pSA->sa_State == STATE_SA_ACTIVE) {
                IPSEC_DEBUG(ACQUIRE, ("Destroying active SA: %lx\n", pSA));
                //
                // Filter is going away, SA must be deleted now
                //
                if (!(pSA->sa_Flags & FLAGS_SA_OUTBOUND)) {
                    //ASSERT(pSA->sa_AssociatedSA);
                    IPSecDeleteInboundSA(pSA);
                } else {
                    ASSERT(pSA->sa_AssociatedSA);
                    if (pSA->sa_AssociatedSA->sa_State == STATE_SA_ASSOCIATED) {
                        IPSecDeleteLarvalSA(pSA->sa_AssociatedSA);
                    } else {
                        IPSecDeleteInboundSA(pSA->sa_AssociatedSA);
                    }
                }
            } else {
                IPSEC_DEBUG(ACQUIRE, ("Destroying larval SA: %lx\n", pSA));
                //
                // SA undergoing negotiation - just invalidate the context.
                // the timer will take care of the rest
                //
                if (pSA->sa_AssociatedSA) {
                    if (pSA->sa_AssociatedSA->sa_AcquireCtx) {
                        IPSecInvalidateHandle(pSA->sa_AssociatedSA->sa_AcquireCtx);
                        pSA->sa_AssociatedSA->sa_AcquireCtx = NULL;
                    }
                }

                IPSecDeleteLarvalSA(pSA);
            }
        }
    }

    //
    // Also need to remove all those larval SAs whose sa_Filter is pointing
    // to the filter being deleted.
    //
    ACQUIRE_LOCK(&g_ipsec.LarvalListLock, &kIrql);

    pEntry = g_ipsec.LarvalSAList.Flink;
    while (pEntry != &g_ipsec.LarvalSAList) {
        pSA = CONTAINING_RECORD(pEntry,
                                SA_TABLE_ENTRY,
                                sa_LarvalLinkage);
        pEntry = pEntry->Flink;

        if (pSA->sa_Filter == pFilter) {
            IPSecRemoveEntryList(&pSA->sa_LarvalLinkage);
            IPSEC_DEC_STATISTIC(dwNumPendingKeyOps);
            IPSecCleanupLarvalSA(pSA);
        }
    }

    RELEASE_LOCK(&g_ipsec.LarvalListLock, kIrql);

    return  STATUS_SUCCESS;
}


NTSTATUS
IPSecSetupSALifetime(
    IN  PSA_TABLE_ENTRY pSA
    )
/*++

Routine Description:

    Setup the SA lifetime characteristics for rekey and idle timeout.

Arguments:


Return Value:


--*/
{
    LARGE_INTEGER   CurrentTime;
    LARGE_INTEGER   Delta = {0};
    LARGE_INTEGER   Pad = {(pSA->sa_Flags & FLAGS_SA_INITIATOR)?
                            IPSEC_EXPIRE_TIME_PAD_I :
                            IPSEC_EXPIRE_TIME_PAD_R,
                            0};

    //
    // pSA->sa_Lifetime.KeyExpirationTime is in seconds.
    //
    if (pSA->sa_Lifetime.KeyExpirationTime) {
        IPSEC_CONVERT_SECS_TO_100NS(Delta, pSA->sa_Lifetime.KeyExpirationTime);

        NdisGetCurrentSystemTime(&CurrentTime);

        pSA->sa_KeyExpirationTime.QuadPart = (CurrentTime.QuadPart + Delta.QuadPart);

        pSA->sa_KeyExpirationTimeWithPad.QuadPart = pSA->sa_KeyExpirationTime.QuadPart - Pad.QuadPart;

        if (!(pSA->sa_KeyExpirationTimeWithPad.QuadPart > 0i64)) {
            pSA->sa_KeyExpirationTimeWithPad.QuadPart = 0i64;
        }
    }

    //
    // pSA->sa_Lifetime.KeyExpirationBytes is in Kbytes.
    //
    if (pSA->sa_Lifetime.KeyExpirationBytes) {
        pSA->sa_KeyExpirationBytes.LowPart = pSA->sa_Lifetime.KeyExpirationBytes;
        pSA->sa_KeyExpirationBytes = EXTENDED_MULTIPLY(pSA->sa_KeyExpirationBytes, 1024);

        if (pSA->sa_Flags & FLAGS_SA_INITIATOR) {
            pSA->sa_KeyExpirationBytesWithPad.LowPart = pSA->sa_Lifetime.KeyExpirationBytes * IPSEC_EXPIRE_THRESHOLD_I / 100;
        } else {
            pSA->sa_KeyExpirationBytesWithPad.LowPart = pSA->sa_Lifetime.KeyExpirationBytes * IPSEC_EXPIRE_THRESHOLD_R / 100;
        }

        pSA->sa_KeyExpirationBytesWithPad = EXTENDED_MULTIPLY(pSA->sa_KeyExpirationBytesWithPad, 1024);
    }

    //
    // Also setup the idle timeout characteristics.
    //
    if (pSA->sa_Flags & FLAGS_SA_INITIATOR) {
        IPSEC_CONVERT_SECS_TO_100NS(pSA->sa_IdleTime,
                                    (g_ipsec.DefaultSAIdleTime + IPSEC_DEFAULT_SA_IDLE_TIME_PAD_I));
    } else {
        IPSEC_CONVERT_SECS_TO_100NS(pSA->sa_IdleTime,
                                    (g_ipsec.DefaultSAIdleTime + IPSEC_DEFAULT_SA_IDLE_TIME_PAD_R));
    }

    return  STATUS_SUCCESS;
}

DWORD ConvertAddr(IPAddr Addr, IPAddr Mask, ADDR* OutAddr)
{

    if (Mask == 0xffffffff) {
        OutAddr->AddrType=IP_ADDR_UNIQUE;
    } else {
        OutAddr->AddrType=IP_ADDR_SUBNET;
    }
    
    OutAddr->uSubNetMask=Mask;
    OutAddr->uIpAddr=Addr;

    return STATUS_SUCCESS;

}

DWORD ConvertSAToIPSecQMSA(PIPSEC_QM_SA pOutSA,
                           PSA_TABLE_ENTRY pInSA)
/*++

Routine Description:

    Convert SA_TABLE_ENTRY to IPSEC_QM_SA

Arguments:


Return Value:


--*/
{
    int i;

    memcpy(&pOutSA->gQMPolicyID,&pInSA->sa_Filter->PolicyId,sizeof(GUID));
    memcpy(&pOutSA->gQMFilterID,&pInSA->sa_Filter->FilterId,sizeof(GUID));
    
    memcpy(&pOutSA->MMSpi.Initiator,&pInSA->sa_CookiePair.Initiator,sizeof(IKE_COOKIE));
    memcpy(&pOutSA->MMSpi.Responder,&pInSA->sa_CookiePair.Responder,sizeof(IKE_COOKIE));

    ConvertAddr(pInSA->SA_SRC_ADDR,pInSA->SA_SRC_MASK,&pOutSA->IpsecQMFilter.SrcAddr);
    ConvertAddr(pInSA->SA_DEST_ADDR,pInSA->SA_DEST_MASK,&pOutSA->IpsecQMFilter.DesAddr);

    pOutSA->IpsecQMFilter.Protocol.ProtocolType=PROTOCOL_UNIQUE;
    pOutSA->IpsecQMFilter.Protocol.dwProtocol=pInSA->SA_PROTO;

    pOutSA->IpsecQMFilter.SrcPort.PortType=PORT_UNIQUE;
    pOutSA->IpsecQMFilter.SrcPort.wPort=NET_SHORT(SA_SRC_PORT(pInSA));

    pOutSA->IpsecQMFilter.DesPort.PortType=PORT_UNIQUE;
    pOutSA->IpsecQMFilter.DesPort.wPort=NET_SHORT(SA_DEST_PORT(pInSA));

    if (pInSA->sa_Flags & FLAGS_SA_TUNNEL) {
        pOutSA->IpsecQMFilter.QMFilterType = QM_TUNNEL_FILTER;
        ConvertAddr(pInSA->sa_SrcTunnelAddr,0xffffffff,&pOutSA->IpsecQMFilter.MyTunnelEndpt);
        ConvertAddr(pInSA->sa_TunnelAddr,0xffffffff,&pOutSA->IpsecQMFilter.PeerTunnelEndpt);
        
    } else {
        pOutSA->IpsecQMFilter.QMFilterType = QM_TRANSPORT_FILTER;
    }

    pOutSA->SelectedQMOffer.dwPFSGroup=pInSA->sa_QMPFSGroup;
    if (pOutSA->SelectedQMOffer.dwPFSGroup) {
        pOutSA->SelectedQMOffer.bPFSRequired=TRUE;
    }
    pOutSA->SelectedQMOffer.Lifetime.uKeyExpirationTime=pInSA->sa_Lifetime.KeyExpirationTime;
    pOutSA->SelectedQMOffer.Lifetime.uKeyExpirationKBytes=pInSA->sa_Lifetime.KeyExpirationBytes;
    
    pOutSA->SelectedQMOffer.dwNumAlgos=pInSA->sa_NumOps;

    for (i=0; i < pInSA->sa_NumOps;i++) {
        pOutSA->SelectedQMOffer.Algos[i].Operation=pInSA->sa_Operation[i];
        if (pInSA->sa_AssociatedSA) {            
            pOutSA->SelectedQMOffer.Algos[i].MySpi= pInSA->sa_AssociatedSA->sa_OtherSPIs[i];
        }        
        pOutSA->SelectedQMOffer.Algos[i].PeerSpi= pInSA->sa_OtherSPIs[i];
        
        switch(pOutSA->SelectedQMOffer.Algos[i].Operation) {
        case AUTHENTICATION:            
            pOutSA->SelectedQMOffer.Algos[i].uAlgoIdentifier=pInSA->INT_ALGO(i);            
            pOutSA->SelectedQMOffer.Algos[i].uAlgoKeyLen=pInSA->INT_KEYLEN(i);
            pOutSA->SelectedQMOffer.Algos[i].uAlgoRounds=pInSA->INT_ROUNDS(i);
            break;
        case ENCRYPTION:
            pOutSA->SelectedQMOffer.Algos[i].uAlgoIdentifier=pInSA->CONF_ALGO(i);            
            pOutSA->SelectedQMOffer.Algos[i].uAlgoKeyLen=pInSA->CONF_KEYLEN(i);
            pOutSA->SelectedQMOffer.Algos[i].uAlgoRounds=pInSA->CONF_ROUNDS(i);

            pOutSA->SelectedQMOffer.Algos[i].uSecAlgoIdentifier=pInSA->INT_ALGO(i);            
            pOutSA->SelectedQMOffer.Algos[i].uSecAlgoKeyLen=pInSA->INT_KEYLEN(i);
            break;
        default:
            break;
        }
    }
    return STATUS_SUCCESS;

    

}

BOOLEAN
IPSecMatchSATemplate(
    IN  PSA_TABLE_ENTRY pSA,
    IN  PIPSEC_QM_SA    pSATemplate
    )
/*++

Routine Description:

    Try to see if the SA passed in matches the template.

Arguments:

    pSA         - SA of interest
    pSATemplate - SA template

Return Value:

    TRUE/FALSE

--*/
{
    LARGE_INTEGER   ZeroLI = {0};
    ADDR            ZeroADDR = {0};
    PROTOCOL        ZeroPROTOCOL = {0};
    PORT            ZeroPORT = {0};

    IPSEC_QM_SA CurSA;
    memset(&CurSA,0,sizeof(IPSEC_QM_SA));
    
    ConvertSAToIPSecQMSA(&CurSA,pSA);
    
    return((BOOLEAN)MatchQMSATemplate(pSATemplate,&CurSA));

}